Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42340 State: PUBLISHED Published: 2021-10-14T19:55:14 Last Updated: 2024-08-04T03:30:38.354Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-772 Description: The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org
rvice via an OutOfMemoryError. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E - https://www.debian.org/security/2021/dsa-5009 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211104-0001/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10379 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
10379 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202208-34
CVE ID: CVE-2021-42341 State: PUBLISHED Published: 2021-10-14T05:01:07 Last Updated: 2024-08-04T03:30:38.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 - https://github.com/OpenRC/openrc/issues/459 -
ithub.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 - https://github.com/OpenRC/openrc/issues/459 - https://github.com/OpenRC/openrc/pull/462 - https://bugs.gentoo.org/816900 - https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae - https://github.com/OpenRC/openrc/issues/418
CVE ID: CVE-2021-42342 State: PUBLISHED Published: 2021-10-14T05:08:38 Last Updated: 2024-08-04T03:30:38.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/embedthis/goahead/issues/305
CVE ID: CVE-2021-42343 State: PUBLISHED Published: 2021-10-26T10:23:26 Last Updated: 2024-08-04T03:30:38.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated at
ed using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://docs.dask.org/en/latest/changelog.html - https://github.com/dask/dask/tags - https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
CVE ID: CVE-2021-42357 State: PUBLISHED Published: 2022-01-17T19:25:09 Last Updated: 2024-08-04T03:30:38.347Z Vendors: Apache Software Foundation Products: Apache Knox Problem Types: CWE-79 Description: When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/b7v5dkpyqb51
campaign. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7j - http://www.openwall.com/lists/oss-security/2022/01/17/2
CVE ID: CVE-2021-42358 State: PUBLISHED Published: 2021-11-29T18:10:18.403Z Last Updated: 2025-02-13T20:49:16.649Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Contact Form With Captcha Products: Contact Form With Captcha Problem Types: CWE-352 Description: The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.word
6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/contact-form-with-captcha/trunk/cfwc-form.php#L17 - https://wordfence.com/vulnerability-advisories/#CVE-2021-42358
CVE ID: CVE-2021-42359 State: PUBLISHED Published: 2021-11-05T19:44:54.000Z Last Updated: 2025-02-14T17:52:42.456Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: legalweb Products: WP DSGVO Tools (GDPR) Problem Types: CWE-284 Description: WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsu
an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/
CVE ID: CVE-2021-42360 State: PUBLISHED Published: 2021-11-17T17:45:46.000Z Last Updated: 2025-02-14T17:51:59.040Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: BrainStormForce Products: Starter Templates — Elementor, Gutenberg & Beaver Builder Templates Problem Types: CWE-284, CWE-79, CWE-99 Description: On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, a
ess AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
executed in the browser of any visitors to that page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/11/over-1-million-sites-impacted-by-vulnerability-in-starter-templates-plugin/
CVE ID: CVE-2021-42361 State: PUBLISHED Published: 2021-11-17T18:27:22.508Z Last Updated: 2025-02-14T17:51:38.239Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Contact Form Email Products: Contact Form Email Problem Types: CWE-79 Description: The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for admin
n versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42361 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2628041%40contact-form-to-email&new=2628041%40contact-form-to-email&sfp_email=&sfph_mail=
CVE ID: CVE-2021-42362 State: PUBLISHED Published: 2021-11-17T17:44:23.922336Z Last Updated: 2024-09-16T18:45:18.029Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WordPress Popular Posts Products: WordPress Popular Posts Problem Types: CWE-434 Description: The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2. Additional Analyst Notes: - CVE Program Container
o obtain remote code execution, in versions up to and including 5.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/ - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362 - https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/trunk/src/Image.php - https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009 - http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.html - https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601
CVE ID: CVE-2021-42363 State: PUBLISHED Published: 2021-11-19T15:35:08.929Z Last Updated: 2025-02-14T17:50:57.263Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Preview E-Mails for WooCommerce Products: Preview E-Mails for WooCommerce Problem Types: CWE-79 Description: The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changes
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2625941/woo-preview-emails/trunk/views/form.php - https://www.wordfence.com/blog/2021/11/woocommerce-extension-reflected-xss-vulnerability/ - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42363
CVE ID: CVE-2021-42364 State: PUBLISHED Published: 2021-11-29T18:10:33.282Z Last Updated: 2025-02-13T20:48:26.623Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Stetic Products: Stetic Problem Types: CWE-352 Description: The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/stetic/trunk/stetic.php#L129 - https://
CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/stetic/trunk/stetic.php#L129 - https://wordfence.com/vulnerability-advisories/#CVE-2021-42364
CVE ID: CVE-2021-42365 State: PUBLISHED Published: 2021-11-29T18:10:23.593Z Last Updated: 2025-02-13T20:48:57.826Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Asgaros Forums Products: Asgaros Forums Problem Types: CWE-79 Description: The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites wher
ding 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php - https://wordfence.com/vulnerability-advisories/#CVE-2021-42365
CVE ID: CVE-2021-42367 State: PUBLISHED Published: 2021-12-14T15:50:10.177Z Last Updated: 2025-02-13T20:47:20.144Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Variation Swatches for WooCommerce Products: Variation Swatches for WooCommerce Problem Types: CWE-79, CWE-862 Description: The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as
g 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42367 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634227%40variation-swatches-for-woocommerce&new=2634227%40variation-swatches-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2021-42369 State: PUBLISHED Published: 2021-10-14T00:00:00 Last Updated: 2024-08-04T03:30:38.298Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Imagicle/CVE - https://www.imagicle.com/en/resources/download/ - https://zigrin.com/advisories/imagicle-sql-injection
er/Imagicle/CVE - https://www.imagicle.com/en/resources/download/ - https://zigrin.com/advisories/imagicle-sql-injection-vulnerability-in-contacts-csv-export/
CVE ID: CVE-2021-42370 State: PUBLISHED Published: 2021-11-08T04:49:28 Last Updated: 2024-08-04T03:30:38.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.) Additional Analyst Notes: - CVE Program Container: References: - https://stor2rrd.com/note730.php - https://lpar2rrd.com/note730.php - https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx
CVE ID: CVE-2021-42371 State: PUBLISHED Published: 2021-11-08T04:46:24 Last Updated: 2024-08-04T03:30:38.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30. Additional Analyst Notes: - CVE Program Container: References: - https://stor2rrd.com/note730.php - https://lpar2rrd.com/note730.php - https://github.com/orangecertcc/security-research/security/advisories/GHSA-p2fq-9h5j-x6w5
CVE ID: CVE-2021-42372 State: PUBLISHED Published: 2021-11-08T04:44:21 Last Updated: 2024-08-04T03:30:38.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service. Additional Analyst Notes: - CVE Program Container: References: - https://stor2rrd.com/note730.php - https://lpar2rrd.com/note730.php - https://github.com/orangecertcc/security-research/security/advisories/GHSA-xfw3-pgp3-5j2p
CVE ID: CVE-2021-42373 State: PUBLISHED Published: 2021-11-15T00:00:00 Last Updated: 2024-08-04T03:30:38.267Z Vendors: busybox Products: busybox Problem Types: CWE-476 Description: A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ - https://security.netapp.com/advisory/ntap-20211223-0002/ - https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
CVE ID: CVE-2021-42374 State: PUBLISHED Published: 2021-11-15T00:00:00.000Z Last Updated: 2025-11-03T20:34:04.163Z Vendors: busybox Products: busybox Problem Types: CWE-125 Description: An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEH
://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ - https://security.netapp.com/advisory/ntap-20211223-0002/ - https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
CVE ID: CVE-2021-42375 State: PUBLISHED Published: 2021-11-15T00:00:00.000Z Last Updated: 2025-04-23T19:24:13.160Z Vendors: busybox Products: busybox Problem Types: CWE-159 Description: An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/
unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ - https://security.netapp.com/advisory/ntap-20211223-0002/ - https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
CVE ID: CVE-2021-42376 State: PUBLISHED Published: 2021-11-15T00:00:00 Last Updated: 2024-08-04T03:30:38.515Z Vendors: busybox Products: busybox Problem Types: CWE-476 Description: A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U
-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ - https://security.netapp.com/advisory/ntap-20211223-0002/ - https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
CVE ID: CVE-2021-42377 State: PUBLISHED Published: 2021-11-15T00:00:00 Last Updated: 2024-08-04T03:30:38.349Z Vendors: busybox Products: busybox Problem Types: CWE-590 Description: An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input. Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%
14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ - https://security.netapp.com/advisory/ntap-20211223-0002/ - https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog