Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-28674 State: PUBLISHED Published: 2021-07-27T15:41:04 Last Updated: 2024-08-03T21:47:33.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform. Additional Analyst Notes: - CVE P
have node management rights associated with at least one valid group on the platform. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/zFUd2cCj - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674
CVE ID: CVE-2021-28675 State: PUBLISHED Published: 2021-06-02T14:29:12 Last Updated: 2024-08-03T21:47:33.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28675-fix-dos-in-psdimageplugin - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-28676 State: PUBLISHED Published: 2021-06-02T00:00:00 Last Updated: 2024-08-03T21:47:33.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos - https://github.com/python-pillow/Pillow/pull/5377 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33 - https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html - https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856
CVE ID: CVE-2021-28677 State: PUBLISHED Published: 2021-06-02T15:18:49 Last Updated: 2024-08-03T21:47:33.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021
t Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open - https://github.com/python-pillow/Pillow/pull/5377 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33 - https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
CVE ID: CVE-2021-28678 State: PUBLISHED Published: 2021-06-02T15:16:23 Last Updated: 2024-08-03T21:47:33.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos - https://github.com/python-pillow/Pillow/pull/5377 - https://lists.fedoraproject.org/archives/list/package-announce%40lis
https://github.com/python-pillow/Pillow/pull/5377 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ - https://security.gentoo.org/glsa/202107-33
CVE ID: CVE-2021-28680 State: PUBLISHED Published: 2021-12-07T20:32:18 Last Updated: 2024-08-03T21:47:33.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site.
mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://labanskoller.se/blog/2021/03/23/the-devise-extens
ditional Analyst Notes: - CVE Program Container: References: - https://labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680/ - https://github.com/oivoodoo/devise_masquerade/issues/83
CVE ID: CVE-2021-28681 State: PUBLISHED Published: 2021-03-18T03:20:06 Last Updated: 2024-08-03T21:47:33.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pion/webrtc/issues/1708 - https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p
CVE ID: CVE-2021-28682 State: PUBLISHED Published: 2021-05-20T16:15:20 Last Updated: 2024-08-03T21:47:32.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/releases - https://blog.envoyproxy.io - https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36
CVE ID: CVE-2021-28683 State: PUBLISHED Published: 2021-05-20T16:34:19 Last Updated: 2024-08-03T21:47:33.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/releases - https://blog.envoyproxy.io - https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
CVE ID: CVE-2021-28684 State: PUBLISHED Published: 2021-06-21T12:13:26 Last Updated: 2024-08-03T21:47:33.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network (via an XXE attack). Additional Analyst Notes: - CVE Program Container: References: - https://www.powerarchiver.com - https://peterka.tech/blog/posts/cve-2021-28684/
CVE ID: CVE-2021-28685 State: PUBLISHED Published: 2021-04-08T10:18:54 Last Updated: 2024-08-03T21:47:33.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to interact directly with physical memory (by calling one of several driver routines that map physical memory into the virtual address space of the calling process) and to interact with MSR registers. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ -
lyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ - https://gist.github.com/DStraghkov/fba4994ac4bb3a6e2940b21743563df0
CVE ID: CVE-2021-28686 State: PUBLISHED Published: 2021-04-08T10:19:42 Last Updated: 2024-08-03T21:47:33.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This could enable low-privileged users to achieve Denial of Service via a DeviceIoControl. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ - https://gist.github.com/DStraghkov/fba4994ac4bb3a6e2940b21743563df0
CVE ID: CVE-2021-28687 State: PUBLISHED Published: 2021-06-11T14:54:14 Last Updated: 2024-08-03T21:47:33.121Z Vendors: Xen Products: xen Problem Types: unknown Description: HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the
y initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destro
rocess, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-368.txt - https://security.gent
otes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-368.txt - https://security.gentoo.org/glsa/202107-30
CVE ID: CVE-2021-28688 State: PUBLISHED Published: 2021-04-06T18:07:41 Last Updated: 2024-08-03T21:47:33.121Z Vendors: Linux Products: Linux Problem Types: unknown Description: The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was class
, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-371.txt - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE ID: CVE-2021-28689 State: PUBLISHED Published: 2021-06-11T14:53:06 Last Updated: 2024-08-03T21:47:33.181Z Vendors: Xen Products: Xen Problem Types: unknown Description: x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for vir
ort 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-i
ns learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-370.txt
CVE ID: CVE-2021-28690 State: PUBLISHED Published: 2021-06-29T11:16:36 Last Updated: 2024-08-03T21:47:33.124Z Vendors: Xen Products: xen Problem Types: unknown Description: x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-377.txt - https://security.gentoo.org/glsa/2
rogram Container: References: - https://xenbits.xenproject.org/xsa/advisory-377.txt - https://security.gentoo.org/glsa/202107-30
CVE ID: CVE-2021-28691 State: PUBLISHED Published: 2021-06-29T11:30:53 Last Updated: 2024-08-03T21:47:33.196Z Vendors: Linux Products: Linux Problem Types: unknown Description: Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. Addit
with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-374.txt - https://security.gentoo.org/glsa/202107-30 - https://security.netapp.com/advisory/ntap-20210805-0002/
CVE ID: CVE-2021-28692 State: PUBLISHED Published: 2021-06-30T10:27:57 Last Updated: 2024-08-03T21:47:33.190Z Vendors: Xen Products: xen Problem Types: unknown Description: inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappr
a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-373.txt - https://security.gentoo.org/glsa/202107-30
CVE ID: CVE-2021-28693 State: PUBLISHED Published: 2021-06-30T10:32:26 Last Updated: 2024-08-03T21:47:33.196Z Vendors: Xen Products: xen Problem Types: unknown Description: xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-372.txt - https://security.gentoo.org/g
CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-372.txt - https://security.gentoo.org/glsa/202107-30
CVE ID: CVE-2021-28694 State: PUBLISHED Published: 2021-08-27T18:46:32 Last Updated: 2024-08-03T21:47:33.139Z Vendors: Xen Products: xen Problem Types: unknown Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen faile
ey can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696). Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-378.
8696). Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-378.txt - http://www.openwall.com/lists/oss-security/2021/09/01/1 - http://www.openwall.com/lists/oss-security/2021/09/01/5 - http://www.openwall.com/lists/oss-security/2021/09/01/6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/ - https://www.debian.org/security/2021/dsa-4977 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.o
bian.org/security/2021/dsa-4977 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/ - https://security.gentoo.org/glsa/202208-23
CVE ID: CVE-2021-28695 State: PUBLISHED Published: 2021-08-27T18:46:33 Last Updated: 2024-08-03T21:47:33.202Z Vendors: Xen Products: xen Problem Types: unknown Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen faile
CVE ID: CVE-2021-28696 State: PUBLISHED Published: 2021-08-27T18:46:33 Last Updated: 2024-08-03T21:47:33.195Z Vendors: Xen Products: xen Problem Types: unknown Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen faile
CVE ID: CVE-2021-28697 State: PUBLISHED Published: 2021-08-27T18:37:41 Last Updated: 2024-08-03T21:47:33.045Z Vendors: Xen Products: xen Problem Types: unknown Description: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to i