Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-31383 State: PUBLISHED Published: 2021-10-19T18:17:26.471382Z Last Updated: 2024-09-16T20:21:34.268Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: improper usage of a source to destination copy write operation, Denial of Service (DoS), CWE-121 Description: In Point to MultiPoint (P2MP) scenarios within established sessions between network or adjacent neighbors the improper use of a source to destination copy write operation combined with a Stack-based Buffer Overflow on certain specific packets processed by the routing protocol daemon (RPD) of Juniper Networks Junos OS and
er Overflow on certain specific packets processed by the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved sent by a remote unauthenticated network attacker causes the RPD to crash causing a Denial of Service (DoS). Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2. This issue does not affect Juniper Networks Junos
.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 19.2R1. Juniper Networks Junos OS Evolved 20.1 versions prior to 20.1R3-EVO; 20.2 versions prior to 20.2R3-EVO; 20.3 versions prior to 20.3R2-EVO. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11251
CVE ID: CVE-2021-31384 State: PUBLISHED Published: 2021-10-19T18:17:28.030896Z Last Updated: 2024-09-16T17:37:44.972Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-285, CWE-862, CWE-551, CWE-939, CWE-1220 Description: Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherw
ssfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/
CVE ID: CVE-2021-31385 State: PUBLISHED Published: 2021-10-19T18:17:30.207673Z Last Updated: 2024-09-16T16:17:37.197Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-22 Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S19; 15.1 versions prior to 15.1R7-S10; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.
ions prior to 15.1R7-S10; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11253
CVE ID: CVE-2021-31386 State: PUBLISHED Published: 2021-10-19T18:17:31.942657Z Last Updated: 2024-09-17T01:16:54.566Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-311, CWE-325, CWE-693, CWE-300 Description: A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R3-S10; 19.1 ve
R12-S20; 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11254
CVE ID: CVE-2021-31399 State: PUBLISHED Published: 2021-08-13T12:05:23.000Z Last Updated: 2025-05-30T16:01:46.320Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AC:L/AV:A/A:L/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.2n.cz/en_GB/products/ip-access-control/2n-access-unit-2 - https://excellium-services.com/cert-xlm-advisory/cve-2021-31399/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-31399
CVE ID: CVE-2021-31400 State: PUBLISHED Published: 2021-08-19T10:52:57 Last Updated: 2024-08-03T22:55:53.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a panic function if the pointer to the end of the out-of-band data points outside of the TCP segment's data. If the panic function hadn't a trap invocation removed, it will enter an infinite loop and therefore cause DoS (continuous loop or a device reset). Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/new-critical-operational-
dditional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2021-31401 State: PUBLISHED Published: 2021-08-19T11:25:42 Last Updated: 2024-08-03T22:55:53.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https://www.f
s: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2021-31402 State: PUBLISHED Published: 2021-04-15T18:18:52 Last Updated: 2024-08-03T22:55:53.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flutterchina/dio/issues/1130
CVE ID: CVE-2021-31403 State: PUBLISHED Published: 2021-04-23T16:05:41.014749Z Last Updated: 2024-09-16T22:08:44.800Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Vaadin Products: Vaadin, vaadin-server Problem Types: CWE-208 Description: Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31403 - https://github.com/vaadin/framework/pull/1219
gram Container: References: - https://vaadin.com/security/cve-2021-31403 - https://github.com/vaadin/framework/pull/12190 - https://github.com/vaadin/framework/pull/12188
CVE ID: CVE-2021-31404 State: PUBLISHED Published: 2021-04-23T16:05:41.141706Z Last Updated: 2024-09-16T23:46:26.136Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-208 Description: Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack. Additional A
0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31404 - https://github.com/vaadin/flow/pull/9875
CVE ID: CVE-2021-31405 State: PUBLISHED Published: 2021-04-23T16:05:41.259237Z Last Updated: 2024-09-17T02:32:47.630Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Vaadin Products: Vaadin, vaadin-text-field-flow Problem Types: CWE-400 Description: Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31405 - https
ses. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31405 - https://github.com/vaadin/flow-components/pull/442
CVE ID: CVE-2021-31406 State: PUBLISHED Published: 2021-04-23T16:05:41.375797Z Last Updated: 2024-09-17T00:02:31.310Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-208 Description: Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31406 - https://github.co
nal Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31406 - https://github.com/vaadin/flow/pull/10157
CVE ID: CVE-2021-31407 State: PUBLISHED Published: 2021-04-23T16:05:41.485696Z Last Updated: 2024-09-16T17:17:43.411Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-402 Description: Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31407 - https://github.com/vaadin/osgi/issues/50 - https://github.
r: References: - https://vaadin.com/security/cve-2021-31407 - https://github.com/vaadin/osgi/issues/50 - https://github.com/vaadin/flow/pull/10229 - https://github.com/vaadin/flow/pull/10269
CVE ID: CVE-2021-31408 State: PUBLISHED Published: 2021-04-23T16:07:16.629224Z Last Updated: 2024-09-17T02:06:19.701Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Vaadin Products: Vaadin, flow-client Problem Types: CWE-613 Description: Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-
attempted to log out. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31408 - https://github.com/vaadin/flow/pull/10577
CVE ID: CVE-2021-31409 State: PUBLISHED Published: 2021-05-05T19:07:30.536900Z Last Updated: 2024-09-17T04:24:18.976Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Vaadin Products: Vaadin, vaadin-compatibility-server Problem Types: CWE-400 Description: Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31409 - https://github.com/vaadin/framework/iss
VE Program Container: References: - https://vaadin.com/security/cve-2021-31409 - https://github.com/vaadin/framework/issues/12240 - https://github.com/vaadin/framework/pull/12241
CVE ID: CVE-2021-31410 State: PUBLISHED Published: 2021-04-23T16:08:31.003622Z Last Updated: 2024-09-17T02:37:25.412Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Vaadin Products: Designer Problem Types: CWE-402 Description: Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31410
CVE ID: CVE-2021-31411 State: PUBLISHED Published: 2021-05-05T18:15:13.220834Z Last Updated: 2024-09-16T18:08:17.789Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-379 Description: Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds. Additional Analyst Notes: - CVE Program Container: References: - https:/
frontend resources during application rebuilds. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31411 - https://github.com/vaadin/flow/pull/10640
CVE ID: CVE-2021-31412 State: PUBLISHED Published: 2021-06-24T11:33:10.535178Z Last Updated: 2024-09-16T16:18:47.406Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Vaadin Products: Vaadin, flow-server Problem Types: CWE-1295 Description: Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in produ
allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2021-31412 - https://github.com/vaadin/flow/pull/11107
CVE ID: CVE-2021-31414 State: PUBLISHED Published: 2021-04-16T03:50:26 Last Updated: 2024-08-03T22:55:53.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.ryotak.me/advisories/36 - https://github.com/LaurentTreguier/vscode-rpm-spec/commit/e19fb8e29cb48cadfd3238371e060d4ffd3384f9
CVE ID: CVE-2021-31417 State: PUBLISHED Published: 2021-04-29T16:31:03 Last Updated: 2024-08-03T22:55:53.776Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-908 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can lever
mponent. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12131. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-426/
CVE ID: CVE-2021-31418 State: PUBLISHED Published: 2021-04-29T16:31:04 Last Updated: 2024-08-03T22:55:53.781Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-908 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can lever
mponent. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12221. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-429/
CVE ID: CVE-2021-31419 State: PUBLISHED Published: 2021-04-29T16:31:04 Last Updated: 2024-08-03T22:55:53.810Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-908 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can lever
mponent. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12136. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-427/
CVE ID: CVE-2021-31420 State: PUBLISHED Published: 2021-04-29T16:31:05 Last Updated: 2024-08-03T22:55:53.718Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-121 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-leng
issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12220. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-428/
CVE ID: CVE-2021-31421 State: PUBLISHED Published: 2021-04-29T16:31:06 Last Updated: 2024-08-03T22:55:53.787Z Severity: LOW (CVSS 3.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-22 Description: This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An atta
e issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete arbitrary files in the context of the hypervisor. Was ZDI-CAN-12129. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-425/
CVE ID: CVE-2021-31422 State: PUBLISHED Published: 2021-04-29T16:31:06 Last Updated: 2024-08-03T22:55:53.791Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-367 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000e virtual device. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this
The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12527. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-430/