Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ity. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue43075 - https://bugzilla.redhat.com/show_bug.cgi?id=1995234 - https://github.com/python/cpython/pull/24391 - https://ubuntu.com/security/CVE-2021-3733 - https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb - https://security.netapp.com/advisory/ntap-20220407-0001/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE ID: CVE-2021-3734 State: PUBLISHED Published: 2021-08-26T12:48:50 Last Updated: 2024-08-03T17:01:08.346Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: yourls Products: yourls/yourls Problem Types: CWE-1021 Description: yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd - https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe
CVE ID: CVE-2021-3735 State: PUBLISHED Published: 2022-08-26T15:25:40.000Z Last Updated: 2025-02-28T13:07:24.170Z Vendors: n/a Products: QEMU Problem Types: CWE-667 Description: A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.c
em availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1997184 - https://access.redhat.com/security/cve/CVE-2021-3735 - https://security-tracker.debian.org/tracker/CVE-2021-3735
CVE ID: CVE-2021-3736 State: PUBLISHED Published: 2022-08-23T15:51:30 Last Updated: 2024-08-03T17:01:08.297Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1995570 - https://access.redhat.com/security/cve/CVE-2021-3736 - https://github.com/torvalds/linux/commit/de5494af4815a4c9328536c72741229b7de88e7f
CVE ID: CVE-2021-3737 State: PUBLISHED Published: 2022-03-04T00:00:00.000Z Last Updated: 2025-11-03T21:45:09.305Z Vendors: n/a Products: python Problem Types: CWE-835 Description: A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue44022 - https://github.com/python/cpython/pull/25916 - https://bugzilla.redhat.com/show_bug.cgi?id=1995162 - https://github.com/p
ttps://github.com/python/cpython/pull/25916 - https://bugzilla.redhat.com/show_bug.cgi?id=1995162 - https://github.com/python/cpython/pull/26503 - https://ubuntu.com/security/CVE-2021-3737 - https://www.oracle.com/security-alerts/cpujul2022.html - https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html - https://security.netapp.com/advisory/ntap-20220407-0009/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE ID: CVE-2021-3738 State: PUBLISHED Published: 2022-03-02T00:00:00 Last Updated: 2024-08-03T17:01:07.949Z Vendors: n/a Products: samba Problem Types: CWE-416 Description: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-f
ng at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2021-3738.html - https://bugzilla.samba.org/show_bug.cgi?id=14468 - https://bugzilla.redhat.com/show_bug.cgi?id=2021726 - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2021-3739 State: PUBLISHED Published: 2022-03-07T15:19:47 Last Updated: 2024-08-03T17:01:07.948Z Vendors: n/a Products: kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1997958 - https://ubuntu.com/security/CVE-2021-3739 - https://www.openwall.com/lists/os
zilla.redhat.com/show_bug.cgi?id=1997958 - https://ubuntu.com/security/CVE-2021-3739 - https://www.openwall.com/lists/oss-security/2021/08/25/3 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091 - https://github.com/torvalds/linux/commit/e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091 - https://security.netapp.com/advisory/ntap-20220407-0006/
CVE ID: CVE-2021-3740 State: PUBLISHED Published: 2024-11-15T10:57:09.236Z Last Updated: 2024-11-15T19:03:09.228Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-384 Description: A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1625470476437-chatwoot/chatwoo
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1625470476437-chatwoot/chatwoot - https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c
CVE ID: CVE-2021-3741 State: PUBLISHED Published: 2024-11-15T10:51:22.667Z Last Updated: 2024-11-20T22:36:41.760Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hu
ecuted, leading to potential security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1625474692857-chatwoot/chatwoot - https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c
CVE ID: CVE-2021-3742 State: PUBLISHED Published: 2024-11-15T10:51:25.968Z Last Updated: 2024-11-18T14:53:23.071Z Severity: HIGH (CVSS 7.9 CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.c
otentially leading to host redirection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1625472546121-chatwoot/chatwoot - https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50c
CVE ID: CVE-2021-3743 State: PUBLISHED Published: 2022-03-04T15:52:55 Last Updated: 2024-08-03T17:01:08.327Z Vendors: n/a Products: Kernel Problem Types: CWE-125 Description: An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1997961 - https://lists.openwall.net/netdev/2021/08/17/124 - https://www.openwall.co
bugzilla.redhat.com/show_bug.cgi?id=1997961 - https://lists.openwall.net/netdev/2021/08/17/124 - https://www.openwall.com/lists/oss-security/2021/08/27/2 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e78c597c3eb - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7e78c597c3ebfd0cb329aa09a838734147e4f117 - https://github.com/torvalds/linux/commit/7e78c597c3ebfd0cb329aa09a838734147e4f117 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220407-0007/
CVE ID: CVE-2021-3744 State: PUBLISHED Published: 2022-03-04T15:55:17 Last Updated: 2024-08-03T17:01:08.447Z Vendors: n/a Products: kernel Problem Types: CWE-401 Description: A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/09/14/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/ - https://lists.
.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/ - https://bugzilla.redhat.com/show_bug.cgi?id=2000627 - https://seclists.org/oss-sec/2021/q3/164 - https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0 - https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680 - https://lists.de
42ae680%5E%21/#F0 - https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-3745 State: PUBLISHED Published: 2021-10-28T17:05:12 Last Updated: 2024-08-03T17:01:08.295Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: flatcore Products: flatcore/flatcore-cms Problem Types: CWE-434 Description: flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7879ab3d-8018-402a-aa0b-131bdbd1966c - https://github.com/flatcore/flatcore-cms/commit/5cc3937b6bc38293ec921a5cf00018b48b668dc6
CVE ID: CVE-2021-3746 State: PUBLISHED Published: 2021-10-19T14:07:43 Last Updated: 2024-08-03T17:01:07.979Z Vendors: n/a Products: libtpms Problem Types: CWE-119 Description: A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1998588
CVE ID: CVE-2021-3747 State: PUBLISHED Published: 2021-10-01T02:35:24.611643Z Last Updated: 2024-09-17T04:19:16.521Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Products: Multipass Problem Types: CWE-732 Description: The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/canonical/multipass/issues/2261
CVE ID: CVE-2021-3748 State: PUBLISHED Published: 2022-03-23T19:46:40 Last Updated: 2024-08-03T17:09:08.293Z Vendors: n/a Products: QEMU (virtio-net) Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.
the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1998514 - https://ubuntu.com/security/CVE-2021-3748 - https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6 - https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg00388.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html - https://security.netapp.com/advisory/ntap-20220425-0004/ - https://security.gentoo.org/glsa/202208-27 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-3749 State: PUBLISHED Published: 2021-08-31T10:36:43 Last Updated: 2024-08-03T17:09:08.302Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: axios Products: axios/axios Problem Types: CWE-1333 Description: axios is vulnerable to Inefficient Regular Expression Complexity Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31 - https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929 - https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rf
027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321%40%3
ruid.apache.org%3E - https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a%40%3Cdev.druid.apache.org%3E - https://www.oracle.com/security-a
a094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a%40%3Cdev.druid.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE ID: CVE-2021-3750 State: PUBLISHED Published: 2022-05-02T18:48:12 Last Updated: 2024-08-03T17:09:08.277Z Vendors: n/a Products: QEMU Problem Types: CWE-416 Description: A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potenti
guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1999073 - https://gitlab.com/qemu-project/qemu/-/issues/541 - https://gitlab.com/qemu-project/qemu/-/issues/556 - https://security.netapp.com/advisory/ntap-20220624-0003/ - https://security.gentoo.org/glsa/202208-27
CVE ID: CVE-2021-3751 State: PUBLISHED Published: 2021-09-15T06:40:10 Last Updated: 2024-08-03T17:09:08.310Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-787 Description: libmobi is vulnerable to Out-of-bounds Write Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fcb4383c-bc27-4b89-bfce-6b041f0cb769 - https://github.com/bfabiszewski/libmobi/commit/ab5bf0e37e540eac682a14e628853b918626e72b
CVE ID: CVE-2021-3752 State: PUBLISHED Published: 2022-02-16T18:35:34 Last Updated: 2024-08-03T17:09:08.291Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1999544 - https://lore.kernel.org/lkml/20211115165435.133245
: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1999544 - https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org/ - https://www.openwall.com/lists/oss-security/2021/09/15/4 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220318-0009/
CVE ID: CVE-2021-3753 State: PUBLISHED Published: 2022-02-16T00:00:00 Last Updated: 2024-08-03T17:09:08.286Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1999589 - https://github.com/torvalds/linux/commit/2287a51ba822384834dafc1c798453375d1107c7 - https://www.openwall.com/lists/oss-
https://github.com/torvalds/linux/commit/2287a51ba822384834dafc1c798453375d1107c7 - https://www.openwall.com/lists/oss-security/2021/09/01/4 - https://security.netapp.com/advisory/ntap-20221028-0003/
CVE ID: CVE-2021-3754 State: PUBLISHED Published: 2022-08-26T15:25:40 Last Updated: 2024-08-03T17:09:08.286Z Vendors: n/a Products: keycloak Problem Types: CWE-20 Description: A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1999196 - https://access.redhat.com/security/cve/CVE-2021-3754
CVE ID: CVE-2021-3755 State: REJECTED Published: 2021-10-18T13:32:18 Last Updated: 2021-10-18T13:32:18 Description: No description available.
CVE ID: CVE-2021-3756 State: PUBLISHED Published: 2021-10-29T15:55:10 Last Updated: 2024-08-03T17:09:08.791Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: hoene Products: hoene/libmysofa Problem Types: CWE-122 Description: libmysofa is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7ca8d9ea-e2a6-4294-af28-70260bb53bc1 - https://github.com/hoene/libmysofa/commit/890400ebd092c574707d0c132124f8ff047e20e1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WGY7TAZX2M4NYXXGNHIBBKKN5XMSMKQ4/ - https://lists.fedoraproject.org/archiv
ge-announce%40lists.fedoraproject.org/message/WGY7TAZX2M4NYXXGNHIBBKKN5XMSMKQ4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PGQ45S4RH7MC42NHTAGOIHYR4C5IRTMZ/
CVE ID: CVE-2021-3757 State: PUBLISHED Published: 2021-09-02T12:06:26 Last Updated: 2024-08-03T17:09:09.144Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: immerjs Products: immerjs/immer Problem Types: CWE-1321 Description: immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Additional Analyst Notes: - CVE Program Container: References: - https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237 - https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa
CVE ID: CVE-2021-3758 State: PUBLISHED Published: 2021-09-02T12:06:27 Last Updated: 2024-08-03T17:09:08.264Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-918 Description: bookstack is vulnerable to Server-Side Request Forgery (SSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a8d7fb24-9a69-42f3-990a-2db93b53f76b - https://github.com/bookstackapp/bookstack/commit/bee5e2c7ca637d034c6985c0328cef0ce068778e