Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-4007 State: PUBLISHED Published: 2021-12-14T14:55:14.461843Z Last Updated: 2024-09-16T21:57:47.130Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rapid7 Products: Insight Agent Problem Types: CWE-427 Description: Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent versions 3.0.1 to 3.1.2.34 start, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SY
thenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 3.1.2.35. This vulnerability is a regression of CVE-2019-5629. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/insightagent/20211210/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5629
CVE ID: CVE-2021-4008 State: PUBLISHED Published: 2021-12-17T00:00:00 Last Updated: 2024-08-03T17:16:03.613Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-119 Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.x.org/archives/xorg-announce/2021-December/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/a
r/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDHYZM6FII35JA7J275MFCJO6ADJUPQX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57DCF726O5LLTST4NBL5PQ7DLPB46HT/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1547/ - https://www.debian.org/security/2021/dsa-5027 - https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archi
age-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/ - https://security.netapp.com/advisory/ntap-20220114-0004/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2021-4009 State: PUBLISHED Published: 2021-12-17T00:00:00 Last Updated: 2024-08-03T17:16:03.422Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-119 Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.x.org/archives/xorg-announce/2021-December/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.
cember/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDHYZM6FII35JA7J275MFCJO6ADJUPQX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57DCF726O5LLTST4NBL5PQ7DLPB46HT/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1548/ - https://www.debian.org/security/2021/dsa-5027 - https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/
/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/ - https://security.netapp.com/advisory/ntap-20220114-0004/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2021-4010 State: PUBLISHED Published: 2021-12-17T00:00:00 Last Updated: 2024-08-03T17:16:03.009Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-119 Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.x.org/archives/xorg-announce/2021-December/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/arch
03122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDHYZM6FII35JA7J275MFCJO6ADJUPQX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57DCF726O5LLTST4NBL5PQ7DLPB46HT/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1549/ - https://www.debian.org/security/2021/dsa-5027 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6
PJAFXOK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/ - https://security.netapp.com/advisory/ntap-20220114-0004/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2021-4011 State: PUBLISHED Published: 2021-12-17T00:00:00 Last Updated: 2024-08-03T17:16:03.680Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-119 Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.x.org/archives/xorg-announce/2021-December/003122.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/archives/
.html - https://lists.x.org/archives/xorg-announce/2021-December/003124.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDHYZM6FII35JA7J275MFCJO6ADJUPQX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T57DCF726O5LLTST4NBL5PQ7DLPB46HT/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1550/ - https://www.debian.org/security/2021/dsa-5027 - https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archives/list
unce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/ - https://security.netapp.com/advisory/ntap-20220114-0004/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2021-4014 State: REJECTED Published: 2022-06-01T14:33:01 Last Updated: 2022-06-01T14:33:01 Description: No description available.
CVE ID: CVE-2021-4015 State: PUBLISHED Published: 2021-12-01T10:20:11 Last Updated: 2024-08-03T17:16:03.289Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b698d445-602d-4701-961c-dffe6d3009b1 - https://github.com/firefly-iii/firefly-iii/commit/518b4ba5a7a56760902758ae0a2c6a392c2f4d37
CVE ID: CVE-2021-4016 State: PUBLISHED Published: 2022-01-21T18:00:11.396123Z Last Updated: 2024-09-16T22:30:10.497Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Rapid7 Products: Insight Agent Problem Types: CWE-284 Description: Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_info.json, leading to a loss of confidentiality. This issue was fixed in Rapid7 Insight Agent 3.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://docs
e was fixed in Rapid7 Insight Agent 3.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/insightagent/20220119/
CVE ID: CVE-2021-4017 State: PUBLISHED Published: 2021-12-01T10:15:11 Last Updated: 2024-08-03T17:16:03.760Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-352 Description: showdoc is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1d8439e8-b3f7-40f8-8b30-f9cb05ff2bcd - https://github.com/star7th/showdoc/commit/654e871a3923e79076818a9a03533fe88222c871
CVE ID: CVE-2021-4018 State: PUBLISHED Published: 2021-12-01T10:00:11 Last Updated: 2024-08-03T17:16:03.243Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c14395f6-bf0d-4b06-b4d1-b509d8a99b54 - https://github.com/snipe/snipe-it/commit/ff81e6d5366c2cfb15618793ad919ae4cbb3ac57
CVE ID: CVE-2021-4019 State: PUBLISHED Published: 2021-12-01T00:00:00.000Z Last Updated: 2025-11-03T20:33:51.211Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d8798584-a6c9-4619-b18f-001b9a6fca92 - https://github.com/vim/vim/commit/bd228fd097b41a798f90944b5d1245eddd484142 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRPAI5JVZLI7WHWSBR6NWAPBQAYUQREW/ - https://lists.fedoraproject.org/archives/list/package-annou
edoraproject.org/message/DRPAI5JVZLI7WHWSBR6NWAPBQAYUQREW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-4020 State: PUBLISHED Published: 2021-11-27T09:15:11 Last Updated: 2024-08-03T17:16:02.962Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: meetecho Products: meetecho/janus-gateway Problem Types: CWE-79 Description: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9814baa8-7bdd-4e31-a132-d9d15653409e - https://github.com/meetecho/janus-gateway/commit/d3fc00ec803d6c41d8f98908732f44e7f4911a1c
CVE ID: CVE-2021-4021 State: PUBLISHED Published: 2022-02-24T18:50:10 Last Updated: 2024-08-03T17:16:03.457Z Vendors: n/a Products: radare2 Problem Types: CWE-400 Description: A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radareorg/radare2/issues/19436
CVE ID: CVE-2021-4022 State: PUBLISHED Published: 2022-08-25T17:26:43 Last Updated: 2024-08-03T17:16:03.280Z Vendors: n/a Products: rizin Problem Types: CWE-400 Description: A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafted binarygets analysed by rizin, it causes rizin to crash by freeing an uninitialized (and potentially user controlled, depending on the build) memory address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rizinorg/rizin/issues/2015
CVE ID: CVE-2021-4023 State: PUBLISHED Published: 2022-03-09T16:49:04 Last Updated: 2024-08-03T17:16:03.222Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to possibly crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2026484
CVE ID: CVE-2021-4024 State: PUBLISHED Published: 2021-12-23T19:48:45 Last Updated: 2024-08-03T17:16:03.464Z Vendors: n/a Products: podman Problem Types: CWE-200 Description: A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's serv
making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2026675%2C - https://github.com/containers/podman/releases/tag/v3.4.3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QFFVJ6S3ZRMPDYB7KYAWEMDHXFZYQPU3/
CVE ID: CVE-2021-4026 State: PUBLISHED Published: 2021-11-30T19:55:10 Last Updated: 2024-08-03T17:16:03.288Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-284 Description: bookstack is vulnerable to Improper Access Control Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c6dfa80d-43e6-4b49-95af-cc031bb66b1d - https://github.com/bookstackapp/bookstack/commit/b4fa82e3298a15443ca40bff205b7a16a1031d92
CVE ID: CVE-2021-4028 State: PUBLISHED Published: 2022-08-24T00:00:00 Last Updated: 2024-08-03T17:16:04.248Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2021/10/4/697 - https://git.kernel.org/pub/scm/linux/kernel/git
E Program Container: References: - https://lkml.org/lkml/2021/10/4/697 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74 - https://bugzilla.redhat.com/show_bug.cgi?id=2027201 - https://access.redhat.com/security/cve/CVE-2021-4028 - https://bugzilla.suse.com/show_bug.cgi?id=1193167#c0 - https://security.netapp.com/advisory/ntap-20221228-0002/
CVE ID: CVE-2021-4029 State: PUBLISHED Published: 2022-02-22T14:25:14 Last Updated: 2024-08-03T17:16:03.566Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ARMOR Z2 (NBG6817) firmware, ARMOR Z1 (NBG6816) firmware Problem Types: CWE-78 Description: A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml
CVE ID: CVE-2021-4030 State: PUBLISHED Published: 2022-02-22T14:25:10 Last Updated: 2024-08-03T17:16:03.558Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ARMOR Z2 (NBG6817) firmware, ARMOR Z1 (NBG6816) firmware Problem Types: CWE-352 Description: A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml
CVE ID: CVE-2021-4031 State: PUBLISHED Published: 2022-03-18T17:59:06.904697Z Last Updated: 2024-09-16T20:11:23.615Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Syltek Products: Syltek Problem Types: CWE-345 Description: Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/syltek-insufficient-verification-data-authenticity
CVE ID: CVE-2021-4032 State: PUBLISHED Published: 2022-01-21T18:17:29 Last Updated: 2024-08-03T17:16:03.043Z Vendors: n/a Products: kernel Problem Types: CWE-459 Description: A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2027403 - ht
dditional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2027403 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7d8a19f9a056a05c5c509fa65af472a322abfee - https://lkml.org/lkml/2021/9/8/587
CVE ID: CVE-2021-4033 State: PUBLISHED Published: 2021-12-09T19:55:10 Last Updated: 2024-08-03T17:16:03.733Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-352 Description: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e05be1f7-d00c-4cfd-9390-ccd9d1c737b7 - https://github.com/kevinpapst/kimai2/commit/1da26e041df62c10bd8075d78f2db7854d3eee07
CVE ID: CVE-2021-4034 State: PUBLISHED Published: 2022-01-28T00:00:00.000Z Last Updated: 2025-10-21T23:15:48.549Z Vendors: n/a Products: polkit Problem Types: CWE-787 Description: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully execut
by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 - https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt - https://bugzilla.redhat.com/show_bug.cgi?id=2025869 - https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 - https://www.oracle.com/security-alerts/cpuapr2022.html - http://packetstormsecurity.com/
6ae46cbd5c779d3055bff81ded683 - https://www.oracle.com/security-alerts/cpuapr2022.html - http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html - http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html - https://www.suse.com/support/kb/doc/?id=000020564 - https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf - https://www.starwindsoftware.com/security/sw-20220818-0001/ - https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/
CVE ID: CVE-2021-4035 State: PUBLISHED Published: 2022-02-11T17:40:04.786449Z Last Updated: 2024-09-16T16:38:39.868Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: A3Sec Products: Wocu Monitoring Problem Types: CWE-79 Description: A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss
CVE ID: CVE-2021-4037 State: PUBLISHED Published: 2022-08-24T00:00:00 Last Updated: 2024-08-03T17:16:02.950Z Vendors: n/a Products: Kernel Problem Types: CWE-284 Description: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and
ssive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2004810 - https://bugzilla.redhat.com/show_bug.cgi?id=2027239 - https://access.redhat.com/security/cve/CVE-2021-4037 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848 - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html