Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3910 State: PUBLISHED Published: 2021-11-11T21:45:21.177058Z Last Updated: 2024-09-17T03:27:37.742Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-20 Description: OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-5mxh-2qfv-4g7j - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-3911 State: PUBLISHED Published: 2021-11-11T21:45:22.690851Z Last Updated: 2024-09-16T22:31:10.731Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-20 Description: If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-w6ww-fmfx-2x22 - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-3912 State: PUBLISHED Published: 2021-11-11T21:45:24.415500Z Last Updated: 2024-09-16T23:41:30.954Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-400 Description: OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-g9wh-3vrx-r7hg - https://www.debian.org/security/2022/dsa-5041
CVE ID: CVE-2021-3913 State: REJECTED Published: 2022-08-26T15:25:42 Last Updated: 2022-08-26T15:25:42 Description: No description available.
CVE ID: CVE-2021-3914 State: PUBLISHED Published: 2022-08-25T19:36:49 Last Updated: 2024-08-03T17:09:09.600Z Vendors: n/a Products: smallrye-health Problem Types: CWE-79 Description: It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2018015 - https://access.redhat.com/security/cve/CVE-2021-3914
CVE ID: CVE-2021-3915 State: PUBLISHED Published: 2021-11-13T09:15:10 Last Updated: 2024-08-03T17:09:09.642Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-434 Description: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fcb65f2d-257a-46f4-bac9-f6ded5649079 - https://github.com/bookstackapp/bookstack/commit/ae155d67454d6b9f6c93b2bb457aaa4b2eb1a9ed
CVE ID: CVE-2021-3916 State: PUBLISHED Published: 2021-11-05T14:50:19 Last Updated: 2024-08-03T17:09:09.688Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-22 Description: bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0be32e6b-7c48-43f0-9cec-433000ad8f64 - https://github.com/bookstackapp/bookstack/commit/43830a372fc51a8793199d04a34c3f4ebdfccc7b
CVE ID: CVE-2021-3917 State: PUBLISHED Published: 2022-08-23T19:03:22 Last Updated: 2024-08-03T17:09:09.604Z Vendors: n/a Products: coreos-installer Problem Types: CWE-276 Description: A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coreos/fedora-coreos-tracker/issues/889 - https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c - https:
tracker/issues/889 - https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c - https://bugzilla.redhat.com/show_bug.cgi?id=2018478 - https://access.redhat.com/security/cve/CVE-2021-3917
CVE ID: CVE-2021-3918 State: PUBLISHED Published: 2021-11-13T00:00:00 Last Updated: 2025-01-17T20:02:47.966Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kriszyp Products: kriszyp/json-schema Problem Types: CWE-1321 Description: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9 - https://github.com/kriszyp/json-schema/commit/22f146111f541d9737e832823699ad3528ca7741 - https://lists.debian.org/debian-lts-announce/2022/12/msg00013.html
CVE ID: CVE-2021-3919 State: PUBLISHED Published: 2022-11-21T21:29:50.895Z Last Updated: 2025-04-29T15:27:34.650Z Vendors: HP Inc. Products: OMEN Gaming Hub and HP Command Center Problem Types: n/a Description: A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege and/or denial of service. HP has released software updates to mitigate the potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_5481136-5481162-16/hpsbgn03761
CVE ID: CVE-2021-3920 State: PUBLISHED Published: 2021-11-19T12:15:11 Last Updated: 2024-08-03T17:09:09.696Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: getgrav Products: getgrav/grav-plugin-admin Problem Types: CWE-79 Description: grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ab564760-90c6-4e1d-80c2-852f45034cd1 - https://github.com/getgrav/grav-plugin-admin/commit/6463135bf046d8131189c163158cd5db8f7a9675
CVE ID: CVE-2021-3921 State: PUBLISHED Published: 2021-11-13T08:55:12 Last Updated: 2024-08-03T17:09:09.735Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/724d3fd5-9f04-45c4-98d6-35a7d15468f5 - https://github.com/firefly-iii/firefly-iii/commit/47fa9e39561a9ec9e210e4023d090a7b33381684
CVE ID: CVE-2021-3922 State: PUBLISHED Published: 2022-05-18T16:10:22 Last Updated: 2024-08-03T17:09:09.782Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: IMController Problem Types: CWE-367 Description: A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-75210
CVE ID: CVE-2021-3923 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-24T19:19:01.209Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019643 - https://lore.ke
Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019643 - https://lore.kernel.org/all/20220204100036.GA12348%40kili/
CVE ID: CVE-2021-3924 State: PUBLISHED Published: 2021-11-05T14:50:20 Last Updated: 2024-08-03T17:09:09.660Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: getgrav Products: getgrav/grav Problem Types: CWE-22 Description: grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7ca13522-d0c9-4eff-a7dd-6fd1a7f205a2 - https://github.com/getgrav/grav/commit/8f9c417c04b89dc8d2de60b95e7696821b2826ce
CVE ID: CVE-2021-3927 State: PUBLISHED Published: 2021-11-05T00:00:00 Last Updated: 2024-08-03T17:09:09.701Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0 - https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PGW56Z6IN4UVM3E5RXXF4G7LGGTRBI5C/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/PGW56Z6IN4UVM3E5RXXF4G7LGGTRBI5C/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCQWPEY2AEYBELCMJYHYWYCD3PZVD2H7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-3928 State: PUBLISHED Published: 2021-11-05T00:00:00 Last Updated: 2024-08-03T17:09:09.704Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-457 Description: vim is vulnerable to Use of Uninitialized Variable Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd - https://github.com/vim/vim/commit/15d9890eee53afc61eb0a03b878a19cb5672f732 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PGW56Z6IN4UVM3E5RXXF4G7LGGTRBI5C/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/PGW56Z6IN4UVM3E5RXXF4G7LGGTRBI5C/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCQWPEY2AEYBELCMJYHYWYCD3PZVD2H7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-3929 State: PUBLISHED Published: 2022-08-25T19:36:36.000Z Last Updated: 2025-02-28T13:07:25.655Z Vendors: n/a Products: QEMU Problem Types: CWE-416 Description: A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. Additional Analyst Notes: -
, potentially, executing arbitrary code within the context of the QEMU process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/qemu-project/qemu/-/issues/556 - https://bugzilla.redhat.com/show_bug.cgi?id=2020298 - https://access.redhat.com/security/cve/CVE-2021-3929 - https://gitlab.com/qemu-project/qemu/-/issues/782 - https://gitlab.com/qemu-project/qemu/-/commit/736b01642d85be832385 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHNN7QJCEQH7AQG5AQP2GEFAQE6K635I/
CVE ID: CVE-2021-3930 State: PUBLISHED Published: 2022-02-18T17:50:48 Last Updated: 2024-08-03T17:09:09.783Z Vendors: n/a Products: QEMU Problem Types: CWE-193 Description: An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2020588 - https://security.netapp.com/advisory/ntap-20220225-0007/ - https://lists.debian.org/debian-lts-annou
ug.cgi?id=2020588 - https://security.netapp.com/advisory/ntap-20220225-0007/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html - https://security.gentoo.org/glsa/202208-27 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-3931 State: PUBLISHED Published: 2021-11-13T08:50:10 Last Updated: 2024-08-03T17:09:09.762Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-352 Description: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/03b21d69-3bf5-4b2f-a2cf-872dd677a68f - https://github.com/snipe/snipe-it/commit/0d811d067c8e064252c0143c39d6cd4c3133679e
CVE ID: CVE-2021-3932 State: PUBLISHED Published: 2021-11-13T08:45:10 Last Updated: 2024-08-03T17:09:09.781Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: area17 Products: area17/twill Problem Types: CWE-352 Description: twill is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6ef21e34-f6d9-445a-b657-375c53dc2b43 - https://github.com/area17/twill/commit/81d80d1fbbdd8bb73c020f03c623fd4487bd9b78
CVE ID: CVE-2021-3933 State: PUBLISHED Published: 2022-03-25T00:00:00 Last Updated: 2024-08-03T17:09:09.619Z Vendors: n/a Products: openexr Problem Types: CWE-190 Description: An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019783 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/ - https://secu
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/ - https://security.gentoo.org/glsa/202210-31 - https://www.debian.org/security/2022/dsa-5299 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3934 State: PUBLISHED Published: 2021-11-12T11:45:10 Last Updated: 2024-08-03T17:09:09.615Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ohmyzsh Products: ohmyzsh/ohmyzsh Problem Types: CWE-78 Description: ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ad2b5c3f-a3ce-4407-94dc-354c723310ce - https://github.com/ohmyzsh/ohmyzsh/commit/6cb41b70a6d04301fd50cd5862ecd705ba226c0e
CVE ID: CVE-2021-3935 State: PUBLISHED Published: 2021-11-22T15:59:14.000Z Last Updated: 2025-11-03T19:26:17.293Z Vendors: n/a Products: pgbouncer Problem Types: CWE-89 Description: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021251 - http://www.pgbouncer.org/changelog.html#pgbouncer-116x - https://lists.fedoraproject.org/archives/list/package-announce%
http://www.pgbouncer.org/changelog.html#pgbouncer-116x - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPCV3KRDI5PLLLKADFVIOHACQJLZMLI/ - https://lists.debian.org/debian-lts-announce/2022/02/msg00016.html
CVE ID: CVE-2021-3937 State: REJECTED Published: 2022-02-24T14:30:37 Last Updated: 2022-02-24T14:30:37 Description: No description available.
CVE ID: CVE-2021-3938 State: PUBLISHED Published: 2021-11-13T08:35:10 Last Updated: 2024-08-03T17:09:09.750Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/198a0d67-9189-4170-809b-0f8aea43b063 - https://github.com/snipe/snipe-it/commit/9ed1442bd124710f4178992cc4eca5236c7396b9
CVE ID: CVE-2021-3939 State: PUBLISHED Published: 2021-11-17T03:15:10.949510Z Last Updated: 2024-09-16T18:02:58.362Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubuntu Products: accountsservice Problem Types: CWE-590 Description: Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1. Additional Analyst Notes: - CVE Program Container: Refe
.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1. Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5149-1 - https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1950149 - http://packetstormsecurity.com/files/172848/Ubuntu-accountsservice-Double-Free-Memory-Corruption.html
CVE ID: CVE-2021-3940 State: REJECTED Published: 2022-02-24T14:30:38 Last Updated: 2022-02-24T14:30:38 Description: No description available.
CVE ID: CVE-2021-3941 State: PUBLISHED Published: 2022-03-25T00:00:00 Last Updated: 2024-08-03T17:09:09.632Z Vendors: n/a Products: openexr Problem Types: CWE-369 Description: In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019789 - https://lists.fedoraprojec
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2019789 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/ - https://security.gentoo.org/glsa/202210-31 - https://www.debian.org/security/2022/dsa-5299 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3942 State: PUBLISHED Published: 2022-11-22T23:07:47.320Z Last Updated: 2025-04-25T20:52:47.519Z Vendors: HP Inc. Products: HP Print products and Digital Sending products Problem Types: n/a Description: Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution or LLMNR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_5948778-5949142-16/hpsbpi03780
CVE ID: CVE-2021-3943 State: PUBLISHED Published: 2021-11-22T15:59:29 Last Updated: 2024-08-03T17:09:09.615Z Vendors: n/a Products: moodle Problem Types: CWE-20 Description: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021963 - https://moodle.org/mod/forum/discuss.php?d=429095
CVE ID: CVE-2021-3944 State: PUBLISHED Published: 2021-12-02T16:40:10 Last Updated: 2024-08-03T17:09:09.759Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-352 Description: bookstack is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/65551490-5ade-49aa-8b8d-274c2ca9fdc9 - https://github.com/bookstackapp/bookstack/commit/88e6f93abf54192a69cc8080e0dc6516ee68ccbb
CVE ID: CVE-2021-3945 State: PUBLISHED Published: 2021-11-13T08:25:10 Last Updated: 2024-08-03T17:09:09.599Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: django-helpdesk Products: django-helpdesk/django-helpdesk Problem Types: CWE-79 Description: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4 - https://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30
CVE ID: CVE-2021-3947 State: PUBLISHED Published: 2022-02-18T17:50:50 Last Updated: 2024-08-03T17:09:09.628Z Vendors: n/a Products: QEMU Problem Types: CWE-125 Description: A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2021869 - https://security.netapp.com/advisory/ntap-20220318-0003/ - https://security.gentoo.org/glsa/202208-27
CVE ID: CVE-2021-3948 State: PUBLISHED Published: 2022-02-18T00:00:00 Last Updated: 2024-08-03T17:09:09.782Z Vendors: n/a Products: mig-controller Problem Types: CWE-276 Description: An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integrity, and availability of the services located on that cluster. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2022017