Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41715 State: PUBLISHED Published: 2022-04-08T14:55:27 Last Updated: 2024-08-04T03:15:29.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libsixel/libsixel/issues/27
CVE ID: CVE-2021-41716 State: PUBLISHED Published: 2021-12-07T18:37:35 Last Updated: 2024-08-04T03:15:29.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function Additional Analyst Notes: - CVE Program Container: References: - http://maharashtra.com - https://cvewalkthrough.com/cve-2021-41716-mahavitaran-android-application-account-take-over-via-otp-fixation/
CVE ID: CVE-2021-41719 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-21T16:53:59.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cvewalkthrough.com/cve-2021-41719-mseb-ios-application-sensitive-information-exposure/
CVE ID: CVE-2021-41720 State: REJECTED Published: 2021-09-30T13:12:56 Last Updated: 2021-12-01T15:27:31 Description: No description available.
CVE ID: CVE-2021-41728 State: PUBLISHED Published: 2021-10-28T14:37:07 Last Updated: 2024-08-04T03:15:29.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/CVE-2021-41728
CVE ID: CVE-2021-41729 State: PUBLISHED Published: 2021-09-30T10:43:10 Last Updated: 2024-08-04T03:15:29.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/meiko-S/BaiCloud-cms/issues/3
CVE ID: CVE-2021-41731 State: PUBLISHED Published: 2022-09-16T16:18:09 Last Updated: 2024-08-04T03:15:29.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS vulnerability exists in )Sourcecodester News247 News Magazine (CMS) PHP 5.6 or higher and MySQL 5.7 or higher via the blog category name field Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - http://packetstormsecurity.com/files/168384/News247-News-Magazine-1.0-Cross-Site-Scripting.html - https://cxsecurity.com/issue/WLB-2022090039
CVE ID: CVE-2021-41732 State: PUBLISHED Published: 2021-09-29T18:34:01 Last Updated: 2024-08-04T03:15:29.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zeek/zeek/issues/1798
CVE ID: CVE-2021-41733 State: PUBLISHED Published: 2021-11-08T14:10:44 Last Updated: 2024-08-04T03:15:29.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/oppia/oppia/pull/13892
CVE ID: CVE-2021-41736 State: PUBLISHED Published: 2022-03-22T17:23:04 Last Updated: 2024-08-04T03:15:29.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grame-cncm/faust/issues/653
CVE ID: CVE-2021-41737 State: PUBLISHED Published: 2024-11-10T00:00:00 Last Updated: 2024-11-19T19:46:33.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *;" leads to stack consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grame-cncm/faust/issues/653 - https://github.com/grame-cncm/faust/tree/e682dbeeb7cc0ec9a1fcb6872f53433e454aa233
CVE ID: CVE-2021-41738 State: PUBLISHED Published: 2022-06-11T13:26:10 Last Updated: 2024-08-04T03:15:29.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40rootless724
CVE ID: CVE-2021-41739 State: PUBLISHED Published: 2022-05-05T10:41:00 Last Updated: 2024-08-04T03:15:29.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40rootless724/artica-proxy-4-30-cyrus-events-php-rce-3aa2a868c695
CVE ID: CVE-2021-41744 State: PUBLISHED Published: 2021-10-22T11:40:15 Last Updated: 2024-08-04T03:15:29.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use th
uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-39097
CVE ID: CVE-2021-41745 State: PUBLISHED Published: 2021-10-22T11:56:28 Last Updated: 2024-08-04T03:15:29.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/purple-WL/SHOWDOC-file-upload-vulnerability - https://www.cnvd.org.cn/flaw/show/CNVD-2020-49480
CVE ID: CVE-2021-41746 State: PUBLISHED Published: 2021-10-29T17:22:28 Last Updated: 2024-08-04T03:15:29.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/purple-WL/Yonyou-TurboCRM-SQL-injection/issues/1 - https://www.cnvd.org.cn/flaw/show/CNVD-2020-21956
CVE ID: CVE-2021-41747 State: PUBLISHED Published: 2021-10-22T11:51:35 Last Updated: 2024-08-04T03:15:29.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such as user cookies. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-52394 - https://github.com/purple-WL/Security-vulnerability/blob/main/Csdn%20APP%204.10.0%20XSS
CVE ID: CVE-2021-41748 State: REJECTED Published: 2021-10-29T17:09:19 Last Updated: 2021-12-01T13:55:07 Description: No description available.
CVE ID: CVE-2021-41749 State: PUBLISHED Published: 2022-06-12T11:00:13 Last Updated: 2024-08-04T03:15:29.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md - https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d
CVE ID: CVE-2021-41750 State: PUBLISHED Published: 2022-06-12T11:29:00 Last Updated: 2024-08-04T03:15:29.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nystudio107/craft-
as the extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md - https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873 - https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8
CVE ID: CVE-2021-41751 State: PUBLISHED Published: 2022-04-05T15:37:13 Last Updated: 2024-08-04T03:15:29.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/pull/4797
CVE ID: CVE-2021-41752 State: PUBLISHED Published: 2022-04-05T15:37:54 Last Updated: 2024-08-04T03:15:29.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4779
CVE ID: CVE-2021-41753 State: PUBLISHED Published: 2021-09-27T16:22:43 Last Updated: 2024-08-04T03:15:29.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remote unauthenticated attacker to disconnect a wireless client via sending specific spoofed SAE authentication frames. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10243
CVE ID: CVE-2021-41754 State: PUBLISHED Published: 2022-06-10T20:52:29 Last Updated: 2024-08-04T03:15:29.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md - https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441
CVE ID: CVE-2021-41755 State: PUBLISHED Published: 2022-06-10T21:12:36 Last Updated: 2024-08-04T03:15:29.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md - https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441
CVE ID: CVE-2021-41756 State: PUBLISHED Published: 2022-06-10T21:17:07 Last Updated: 2024-08-04T03:15:29.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md - https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441
CVE ID: CVE-2021-41764 State: PUBLISHED Published: 2021-09-29T19:02:00 Last Updated: 2024-08-04T03:15:29.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/streamaserver/streama - https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f - https://gist.
://github.com/streamaserver/streama - https://gist.github.com/omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f - https://gist.github.com/omriinbar/8277193731d0edf20ef71299f304ab93
CVE ID: CVE-2021-41765 State: PUBLISHED Published: 2021-11-15T15:52:25 Last Updated: 2024-08-04T03:15:29.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server. Additional Analyst Notes: - CVE Program Container: References: - http://svn.resourcespace.com/svn
ry code on the server. Additional Analyst Notes: - CVE Program Container: References: - http://svn.resourcespace.com/svn/rs/releases/9.6/pages/edit_fields/9_ajax/add_keyword.php - https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/
CVE ID: CVE-2021-41766 State: PUBLISHED Published: 2022-01-26T11:10:11 Last Updated: 2024-08-04T03:15:29.312Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: Insecure Java Deserialization Description: Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depen
he Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder). Additional Analyst Notes: - CVE Program Container: References: - https://karaf.apache.org/security/cve-2021-41766.txt
CVE ID: CVE-2021-41767 State: PUBLISHED Published: 2022-01-11T22:10:11 Last Updated: 2024-08-04T03:15:29.360Z Vendors: Apache Software Foundation Products: Apache Guacamole Problem Types: CWE-200 Description: Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro - http://www.openwall.com/lists/oss-security/2
ences: - https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro - http://www.openwall.com/lists/oss-security/2022/01/11/6
CVE ID: CVE-2021-41769 State: PUBLISHED Published: 2022-01-11T11:27:16 Last Updated: 2024-08-04T03:15:29.228Z Vendors: Siemens Products: SIPROTEC 5 6MD85 devices (CPU variant CP300), SIPROTEC 5 6MD86 devices (CPU variant CP300), SIPROTEC 5 6MD89 devices (CPU variant CP300), SIPROTEC 5 6MU85 devices (CPU variant CP300), SIPROTEC 5 7KE85 devices (CPU variant CP300), SIPROTEC 5 7SA82 devices (CPU variant CP100), SIPROTEC 5 7SA86 devices (CPU variant CP300), SIPROTEC 5 7SA87 devices (CPU variant CP300), SIPROTEC 5 7SD82 devices (CPU variant CP100), SIPROTEC 5 7SD86 devices (CPU variant CP300), SIPROTEC 5 7SD87 devices (CPU variant CP300), SIPROTEC 5 7SJ81 devices (CPU variant CP100), SIPROTEC 5
variant CP300), SIPROTEC 5 7SD87 devices (CPU variant CP300), SIPROTEC 5 7SJ81 devices (CPU variant CP100), SIPROTEC 5 7SJ82 devices (CPU variant CP100), SIPROTEC 5 7SJ85 devices (CPU variant CP300), SIPROTEC 5 7SJ86 devices (CPU variant CP300), SIPROTEC 5 7SK82 devices (CPU variant CP100), SIPROTEC 5 7SK85 devices (CPU variant CP300), SIPROTEC 5 7SL82 devices (CPU variant CP100), SIPROTEC 5 7SL86 devices (CPU variant CP300), SIPROTEC 5 7SL87 devices (CPU variant CP300), SIPROTEC 5 7SS85 devices (CPU variant CP300), SIPROTEC 5 7ST85 devices (CPU variant CP300), SIPROTEC 5 7SX85 devices (CPU variant CP300), SIPROTEC 5 7UM85 devices (CPU variant CP300), SIPROTEC 5 7UT82 devices (CPU variant C
7SX85 devices (CPU variant CP300), SIPROTEC 5 7UM85 devices (CPU variant CP300), SIPROTEC 5 7UT82 devices (CPU variant CP100), SIPROTEC 5 7UT85 devices (CPU variant CP300), SIPROTEC 5 7UT86 devices (CPU variant CP300), SIPROTEC 5 7UT87 devices (CPU variant CP300), SIPROTEC 5 7VE85 devices (CPU variant CP300), SIPROTEC 5 7VK87 devices (CPU variant CP300), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) Problem Types: CWE-20 Description: A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC
CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU varian
ions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.
L86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 device
00) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-439673.pdf
CVE ID: CVE-2021-41770 State: PUBLISHED Published: 2021-10-07T06:24:36 Last Updated: 2024-08-04T03:15:29.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingfederate.html - https://docs.pingidentity.com/bundle/pingfederate-103/page/ruz1628492711606.html
CVE ID: CVE-2021-41771 State: PUBLISHED Published: 2021-11-08T00:00:00 Last Updated: 2024-08-04T03:15:29.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/ - https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html - https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://groups.google.com/g/golang-announce/c/0fM21h43arc - https://security.netapp.com/advisory/ntap-20211210-0003/ - https://security.gentoo.org/glsa/202208-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2021-41772 State: PUBLISHED Published: 2021-11-08T00:00:00 Last Updated: 2024-08-04T03:15:29.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/ - https://www.oracle.com/security-aler