Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3862 State: PUBLISHED Published: 2022-01-17T13:50:10 Last Updated: 2024-08-03T17:09:09.601Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: icecoder Products: icecoder/icecoder Problem Types: CWE-79 Description: icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5c9c228e-2a39-4643-bb82-2b02a2b0a601 - https://github.com/icecoder/icecoder/commit/51cf24b2a39138e6a7b5739ef59eb38cd7c39763
CVE ID: CVE-2021-3863 State: PUBLISHED Published: 2021-10-19T12:30:31 Last Updated: 2024-08-03T17:09:09.535Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1dbc8d79-1b53-44a3-a576-faec78f29ba0 - https://github.com/snipe/snipe-it/commit/fc5efd857f61f7e45c61db567bb66612bcb53128
CVE ID: CVE-2021-3864 State: PUBLISHED Published: 2022-08-26T15:25:39 Last Updated: 2024-08-03T17:09:09.586Z Vendors: n/a Products: kernel Problem Types: CWE-284 Description: A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use
in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/10/20/2 - https://bugzilla.redhat.com/show_bug.cgi?id=2015046 - https://access.redhat.com/security/cve/CVE-2021-3864 - https://lore.kernel.org/all/20211221021744.864115-1-longman%40redhat.com/ - https://lore.kernel.org/lkml/20211228170910.623156-1-wander%40redhat.com/ - https://lore.kernel.org/all/20211226150310.GA992%401wt.eu/ - https://security-tracker
10.623156-1-wander%40redhat.com/ - https://lore.kernel.org/all/20211226150310.GA992%401wt.eu/ - https://security-tracker.debian.org/tracker/CVE-2021-3864
CVE ID: CVE-2021-3866 State: PUBLISHED Published: 2022-01-20T10:30:11 Last Updated: 2024-08-03T17:09:09.603Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: zulip Products: zulip/zulip Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5f48dac5-e112-4b23-bbbf-cc00ba83bcf2 - https://github.com/zulip/zulip/commit/3eb2791c3e9695f7d37ffe84e0c2184fae665cb6 - https://blog.zulip.com/2022/01/19/cve-2021-38
//github.com/zulip/zulip/commit/3eb2791c3e9695f7d37ffe84e0c2184fae665cb6 - https://blog.zulip.com/2022/01/19/cve-2021-3866/
CVE ID: CVE-2021-3867 State: REJECTED Published: 2022-02-24T14:30:20 Last Updated: 2022-02-24T14:30:20 Description: No description available.
CVE ID: CVE-2021-3868 State: REJECTED Published: 2022-02-24T14:30:22 Last Updated: 2022-02-24T14:30:22 Description: No description available.
CVE ID: CVE-2021-3869 State: PUBLISHED Published: 2021-10-19T12:30:32 Last Updated: 2024-08-03T17:09:09.917Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: stanfordnlp Products: stanfordnlp/corenlp Problem Types: CWE-611 Description: corenlp is vulnerable to Improper Restriction of XML External Entity Reference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2f8baf6c-14b3-420d-8ede-9805797cd324 - https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a
CVE ID: CVE-2021-3870 State: REJECTED Published: 2022-02-24T14:30:23 Last Updated: 2022-02-24T14:30:23 Description: No description available.
CVE ID: CVE-2021-3871 State: REJECTED Published: 2022-02-24T14:30:24 Last Updated: 2022-02-24T14:30:24 Description: No description available.
CVE ID: CVE-2021-3872 State: PUBLISHED Published: 2021-10-19T12:30:34.000Z Last Updated: 2025-11-03T20:33:49.821Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c958013b-1c09-4939-92ca-92f50aa169e8 - https://github.com/vim/vim/commit/826bfe4bbd7594188e3d74d2539d9707b1c6a14b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/ - https://lists.fedoraproject.org/archives/list/package-annou
edoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2021-3873 State: REJECTED Published: 2022-02-24T14:30:26 Last Updated: 2022-02-24T14:30:26 Description: No description available.
CVE ID: CVE-2021-3874 State: PUBLISHED Published: 2021-10-15T13:40:18 Last Updated: 2024-08-03T17:09:09.594Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-22 Description: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ac268a17-72b5-446f-a09a-9945ef58607a - https://github.com/bookstackapp/bookstack/commit/7224fbcc89f00f2b71644e36bb1b1d96addd1d5a
CVE ID: CVE-2021-3875 State: PUBLISHED Published: 2021-10-15T13:40:20 Last Updated: 2024-08-03T17:09:09.583Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5cdbc168-6ba1-4bc2-ba6c-28be12166a53 - https://github.com/vim/vim/commit/35a319b77f897744eec1155b736e9372c9c5575f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2021-3876 State: REJECTED Published: 2022-02-24T14:30:27 Last Updated: 2022-02-24T14:30:27 Description: No description available.
CVE ID: CVE-2021-3877 State: REJECTED Published: 2022-02-24T14:30:28 Last Updated: 2022-02-24T14:30:28 Description: No description available.
CVE ID: CVE-2021-3878 State: PUBLISHED Published: 2021-10-15T13:40:21 Last Updated: 2024-08-03T17:09:09.613Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stanfordnlp Products: stanfordnlp/corenlp Problem Types: CWE-611 Description: corenlp is vulnerable to Improper Restriction of XML External Entity Reference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a11c889b-ccff-4fea-9e29-963a23a63dd2 - https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99
CVE ID: CVE-2021-3879 State: PUBLISHED Published: 2021-10-19T12:30:35 Last Updated: 2024-08-03T17:09:09.634Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6dccc49e-3843-4a4a-b397-5c659e5f8bfe - https://github.com/snipe/snipe-it/commit/bda23bb1e66fd7ce42c75c69cf5eea4e80865c1c
CVE ID: CVE-2021-3880 State: REJECTED Published: 2022-02-24T14:30:29 Last Updated: 2022-02-24T14:30:29 Description: No description available.
CVE ID: CVE-2021-3881 State: PUBLISHED Published: 2021-10-15T13:40:23 Last Updated: 2024-08-03T17:09:09.571Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-125 Description: libmobi is vulnerable to Out-of-bounds Read Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/540fd115-7de4-4e19-a918-5ee61f5157c1 - https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21
CVE ID: CVE-2021-3882 State: PUBLISHED Published: 2021-10-14T08:20:11 Last Updated: 2024-08-03T17:09:09.825Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: ledgersmb Products: ledgersmb/ledgersmb Problem Types: CWE-614 Description: LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although a
erSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of
be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action. As a workaround, users may configure their Apache or Nginx reverse proxy to add the Secure attribute at the network boundary instead of relying on LedgerSMB. For Apache, please refer to the 'Header always edit' configuration command in the mod_headers module. For Nginx, please refer to the 'proxy_cookie_flags' configuration command. Additional Analyst Notes: - CVE Program Container: Referen
ease refer to the 'proxy_cookie_flags' configuration command. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7061d97a-98a5-495a-8ba0-3a4c66091e9d - https://github.com/ledgersmb/ledgersmb/commit/c242f5a2abf4b99b0da205473cbba034f306bfe2 - https://ledgersmb.org/cve-2021-3882-sensitive-non-secure-cookie
CVE ID: CVE-2021-3883 State: REJECTED Published: 2022-02-24T14:30:31 Last Updated: 2022-02-24T14:30:31 Description: No description available.
CVE ID: CVE-2021-3884 State: REJECTED Published: 2022-02-24T14:30:32 Last Updated: 2022-02-24T14:30:32 Description: No description available.
CVE ID: CVE-2021-3885 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:27.443Z Description: No description available.
CVE ID: CVE-2021-3886 State: REJECTED Published: 2022-02-24T14:30:33 Last Updated: 2022-02-24T14:30:33 Description: No description available.
CVE ID: CVE-2021-3887 State: REJECTED Published: 2022-02-24T14:30:34 Last Updated: 2022-02-24T14:30:34 Description: No description available.
CVE ID: CVE-2021-3888 State: PUBLISHED Published: 2021-10-19T12:30:37 Last Updated: 2024-08-03T17:09:09.585Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-823 Description: libmobi is vulnerable to Use of Out-of-range Pointer Offset Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/722b3acb-792b-4429-a98d-bb80efb8938d - https://github.com/bfabiszewski/libmobi/commit/c78e186739b50d156cb3da5d08d70294f0490853
CVE ID: CVE-2021-3889 State: PUBLISHED Published: 2021-10-19T12:30:38 Last Updated: 2024-08-03T17:09:09.609Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-823 Description: libmobi is vulnerable to Use of Out-of-range Pointer Offset Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21 - https://huntr.dev/bounties/efb3e261-3f7d-4a45-8114-e0ace6b21516
CVE ID: CVE-2021-3892 State: REJECTED Published: 2021-12-23T15:16:37 Last Updated: 2021-12-23T15:16:37 Description: No description available.
CVE ID: CVE-2021-3893 State: REJECTED Published: 2022-02-24T14:30:36 Last Updated: 2022-02-24T14:30:36 Description: No description available.
CVE ID: CVE-2021-3894 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2021-3896 State: REJECTED Published: 2021-11-04T20:50:40 Last Updated: 2021-11-04T20:50:40 Description: No description available.
CVE ID: CVE-2021-3897 State: PUBLISHED Published: 2022-04-22T21:10:13 Last Updated: 2024-08-03T17:09:09.641Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Fan Power Controller2 (FPC2), Lenovo System Management Module (SMM) Problem Types: CWE-288 Description: An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en
SMM2 is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-72615
CVE ID: CVE-2021-3898 State: PUBLISHED Published: 2022-04-22T20:30:35 Last Updated: 2024-08-03T17:09:09.607Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Motorola Products: Device Help Android App, Ready For Android App Problem Types: CWE-295 Description: Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-58311
CVE ID: CVE-2021-3899 State: PUBLISHED Published: 2024-06-03T18:40:32.847Z Last Updated: 2024-08-19T14:10:41.358Z Vendors: Canonical Ltd. Products: Apport Description: There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1948376 - https://ubuntu.com/security/notices/USN-5427-1 - https://www.cve.org/CVERecord?id=CVE-2021-3899
CVE ID: CVE-2021-3900 State: PUBLISHED Published: 2021-10-27T17:45:11 Last Updated: 2024-08-03T17:09:09.618Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/909e55b6-ef02-4143-92e4-bc3e8397db76 - https://github.com/firefly-iii/firefly-iii/commit/c2c8c42ef3194d1aeba8c48240fe2e9063f77635
CVE ID: CVE-2021-3901 State: PUBLISHED Published: 2021-10-27T20:50:09 Last Updated: 2024-08-03T17:09:09.616Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/62508fdc-c26b-4312-bf75-fd3a3f997464 - https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2
CVE ID: CVE-2021-3902 State: PUBLISHED Published: 2024-11-15T10:52:10.986Z Last Updated: 2024-11-18T14:35:29.986Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dompdf Products: dompdf/dompdf Problem Types: CWE-611 Description: An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks. Additional Analyst Not
attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1 - https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
CVE ID: CVE-2021-3903 State: PUBLISHED Published: 2021-10-27T21:00:13 Last Updated: 2024-08-03T17:09:09.620Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/35738a4f-55ce-446c-b836-2fb0b39625f8 - https://github.com/vim/vim/commit/777e7c21b7627be80961848ac560cb0a9978ff43 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DU26T75PYA3OF7XJGNKMT2ZCQEU4UKP5/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/DU26T75PYA3OF7XJGNKMT2ZCQEU4UKP5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN4EX7BPQU7RP6PXCNCSDORUZBXQ4JUH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html
CVE ID: CVE-2021-3904 State: PUBLISHED Published: 2021-10-27T21:10:15 Last Updated: 2024-08-03T17:09:09.612Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: getgrav Products: getgrav/grav Problem Types: CWE-79 Description: grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b1182515-d911-4da9-b4f7-b4c341a62a8d - https://github.com/getgrav/grav/commit/afc69a3229bb6fe120b2c1ea27bc6f196ed7284d
CVE ID: CVE-2021-3905 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T17:09:09.615Z Vendors: n/a Products: openvswitch (ovs) Problem Types: CWE-401 Description: A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019692 - https://access.redhat.com/security/cve/CVE-2021-3905 - https://ubuntu.com/security/CVE-2021-3905 - https://github.com/openvswitch/ovs-issues/issues/226 - https://github.com/openvswitch/ovs/commi
security/CVE-2021-3905 - https://github.com/openvswitch/ovs-issues/issues/226 - https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349 - https://security.gentoo.org/glsa/202311-16
CVE ID: CVE-2021-3906 State: PUBLISHED Published: 2021-10-27T21:20:10 Last Updated: 2024-08-03T17:09:09.761Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-434 Description: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f115bdf5-c06b-4627-a6fa-ba6904a43ba3 - https://github.com/bookstackapp/bookstack/commit/64937ab826b56d086af9ecea532510d37520ebc8
CVE ID: CVE-2021-3907 State: PUBLISHED Published: 2021-11-11T21:45:16.585289Z Last Updated: 2024-09-17T03:18:30.852Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-20, CWE-22 Description: OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/secur
running on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh - https://www.debian.org/security/2021/dsa-5033 - https://www.debian.org/security/2022/dsa-5041 - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959
CVE ID: CVE-2021-3908 State: PUBLISHED Published: 2021-11-11T21:45:18.120994Z Last Updated: 2024-09-16T23:21:31.088Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-400 Description: OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g5gj-9ggf-9vmq - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-3909 State: PUBLISHED Published: 2021-11-11T21:45:19.611444Z Last Updated: 2024-09-16T23:06:15.208Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-400 Description: OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare
eep the connection alive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8cvr-4rrf-f244 - https://www.debian.org/security/2021/dsa-5033 - https://www.debian.org/security/2022/dsa-5041