Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38533 State: PUBLISHED Published: 2021-08-10T23:59:44 Last Updated: 2024-08-04T01:44:22.932Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063776/Security-Advisory-for-Stored-Cross-Site-Scripting-on-RAX40-PSV-2019-0263
CVE ID: CVE-2021-38534 State: PUBLISHED Published: 2021-08-10T23:59:34 Last Updated: 2024-08-04T01:44:23.464Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AC:L/AV:A/A:L/C:L/I:L/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 before 1.0.0.60, D6200 before 1.1.00.36, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.70, D7000v2 before 1.0.0.53, D8500 before 1.0.3.44, DC112A before 1.0.0.42, DGN2200v4 before 1.0.0.110, DGND2200Bv4 before 1.0.0.109, DM200 before 1.0.0.61, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.42, R6050 b
before 1.0.0.109, DM200 before 1.0.0.61, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.42, R6050 before 1.0.1.18, R6080 before 1.0.0.42, R6220 before 1.1.0.80, R6230 before 1.1.0.80, R6250 before 1.0.4.34, R6260 before 1.1.0.64, R6300v2 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.62, R6700 before 1.0.2.6, R6700v2 before 1.2.0.36, R6700v3 before 1.0.2.62, R6800 before 1.2.0.36, R6900 before 1.0.2.4, R6900P before 1.3.1.64, R6900v2 before 1.2.0.36, R7000 before 1.0.9.60, R7000P before 1.3.1.64, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7450 before 1.2.0.36, R7900 before 1.0.3.8, R7900P before 1.4.1.50, R8000 before 1.0.4.28, R8000P before 1.4.1.
0.0.70, R7450 before 1.2.0.36, R7900 before 1.0.3.8, R7900P before 1.4.1.50, R8000 before 1.0.4.28, R8000P before 1.4.1.50, R8300 before 1.0.2.130, R8500 before 1.0.2.130, WNDR3400v3 before 1.0.1.24, WNR2020 before 1.1.0.62, WNR3500Lv2 before 1.2.0.62, XR450 before 2.3.2.40, and XR500 before 2.3.2.40. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063758/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0244
CVE ID: CVE-2021-38535 State: PUBLISHED Published: 2021-08-10T23:59:23 Last Updated: 2024-08-04T01:44:23.440Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.76, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.
2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063773/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0192
CVE ID: CVE-2021-38536 State: PUBLISHED Published: 2021-08-10T23:59:11 Last Updated: 2024-08-04T01:44:22.933Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.
2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063774/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0193
CVE ID: CVE-2021-38537 State: PUBLISHED Published: 2021-08-10T23:59:03 Last Updated: 2024-08-04T01:44:23.474Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.
2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, and RAX40 before 1.0.3.62. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063775/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0245
CVE ID: CVE-2021-38538 State: PUBLISHED Published: 2021-08-10T23:58:41 Last Updated: 2024-08-04T01:44:23.363Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:H/AV:L/A:N/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, R9000 before 1.0.4.26, RAX120 before 1.0.0.78, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and XR500 before 2.3.2.56. Additional Analyst Notes: - CVE Program Con
30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and XR500 before 2.3.2.56. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063761/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0515
CVE ID: CVE-2021-38539 State: PUBLISHED Published: 2021-08-10T23:58:28 Last Updated: 2024-08-04T01:44:22.930Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.10, R8300 before 1.0.2.130, and R8500 before 1.0.2.130. Additional Analyst Notes: - CVE Program Container: References: - ht
R8300 before 1.0.2.130, and R8500 before 1.0.2.130. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000063760/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-and-Gateways-PSV-2018-0385
CVE ID: CVE-2021-38540 State: PUBLISHED Published: 2021-09-09T15:05:09 Last Updated: 2024-08-04T01:44:23.448Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-269 Description: The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec7
Program Container: References: - https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E - https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-38542 State: PUBLISHED Published: 2022-01-04T08:55:21 Last Updated: 2024-08-04T01:44:23.485Z Vendors: Apache Software Foundation Products: Apache James Problem Types: CWE-77 Description: Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/01/04/1 - http://www.openwall.com/lists/oss-security/2022/01/04/1 - http://www.openwall.com/lists/oss-security/2022/09/20/1
CVE ID: CVE-2021-38543 State: PUBLISHED Published: 2021-08-11T15:26:02 Last Updated: 2024-08-04T01:44:23.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to
ected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38544 State: PUBLISHED Published: 2021-08-11T15:25:43 Last Updated: 2024-08-04T01:44:23.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyz
eakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38545 State: PUBLISHED Published: 2021-08-11T15:25:33 Last Updated: 2024-08-04T01:44:23.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the Raspberry Pi supplies power to some speakers. The power indicator LED of the Raspberry Pi is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the powe
cted directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects the Raspberry Pi's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the Raspberry Pi, we can recover the sound played by the speakers. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38546 State: PUBLISHED Published: 2021-08-11T15:25:14 Last Updated: 2024-08-04T01:44:23.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measure
cts their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38547 State: PUBLISHED Published: 2021-08-11T15:24:59 Last Updated: 2024-08-04T01:44:23.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing
ers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38548 State: PUBLISHED Published: 2021-08-11T15:24:48 Last Updated: 2024-08-04T01:44:23.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements o
ir power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38549 State: PUBLISHED Published: 2021-08-11T15:24:29 Last Updated: 2024-08-04T01:44:23.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its
d directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack
CVE ID: CVE-2021-38553 State: PUBLISHED Published: 2021-08-13T15:48:47 Last Updated: 2024-08-04T01:44:23.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-38554 State: PUBLISHED Published: 2021-08-13T15:45:50 Last Updated: 2024-08-04T01:44:23.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-38555 State: PUBLISHED Published: 2021-09-11T11:05:11 Last Updated: 2024-08-04T01:44:23.463Z Vendors: Apache Software Foundation Products: Apache Any23 Problem Types: XML external entity (XXE) injection vulnerability Description: An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that t
ttacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r589d1a9f94dbeee7a0f5dbe8513a0e300dfe669bd964ba2fbfe28e07%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-38556 State: PUBLISHED Published: 2021-08-24T12:33:07 Last Updated: 2024-08-04T01:44:23.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RaspAP/raspap-webgui - https://github.com/RaspAP/raspap-webgui/blob/0e1d652c5e55f812aaf2a5908884e9db179416ee/includes/configure_client.php - https://zerosecuritypenetrationtesting.com/?page_id=306
CVE ID: CVE-2021-38557 State: PUBLISHED Published: 2021-08-24T12:33:01 Last Updated: 2024-08-04T01:44:23.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RaspAP/raspap-webgui - https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/rasp
AP/raspap-webgui - https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/raspap.sudoers - https://zerosecuritypenetrationtesting.com/?page_id=306
CVE ID: CVE-2021-38559 State: PUBLISHED Published: 2021-08-26T12:47:12 Last Updated: 2024-08-04T01:44:23.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.hoteldruid.com - https://vitthals.github.io/writeups/CVEs/Hoteldruid%203.0.2%20XSS
CVE ID: CVE-2021-38560 State: PUBLISHED Published: 2022-02-01T15:25:34 Last Updated: 2024-08-04T01:44:23.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Ivanti-Service-Manager-Asset-Manager-2021-1-Release-Notes?language=en_US - https://github.com/os909/iVANTI-CVE-2021-38560
CVE ID: CVE-2021-38561 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:15:14.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/golang-announce - https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f - https://deps.dev/advisory/OSV/GO-2021-0113 - https:
o.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f - https://deps.dev/advisory/OSV/GO-2021-0113 - https://pkg.go.dev/golang.org/x/text/language
CVE ID: CVE-2021-38562 State: PUBLISHED Published: 2021-10-18T08:52:58 Last Updated: 2024-08-04T01:44:23.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm. Additional Analyst Notes: - CVE Program Container: References: - https://docs.bestpractical.com/release-notes/rt/index.html - https://github.com/bestpractical/rt/commit/70749bb66cb13dd70bd53340c371038a5f3ca57c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JK57CEEXLQF7MGBCUX76DZHXML
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JK57CEEXLQF7MGBCUX76DZHXML7LUSQ/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00019.html
CVE ID: CVE-2021-38563 State: PUBLISHED Published: 2021-08-11T21:16:06 Last Updated: 2024-08-04T01:44:23.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write). Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php