Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21946 State: PUBLISHED Published: 2022-04-14T19:55:58.586Z Last Updated: 2025-04-15T19:08:48.828Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-122 Description: Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer overflow takes place when the `SOF3` precision is lower than 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
place when the `SOF3` precision is lower than 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1375
CVE ID: CVE-2021-21947 State: PUBLISHED Published: 2022-04-14T19:56:00.108Z Last Updated: 2025-04-15T19:08:41.846Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-122 Description: Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer overflow takes place when the `SOF3` precision is greater or equal than 9. Additional Analyst Notes: - CVE Program Container: - CISA A
place when the `SOF3` precision is greater or equal than 9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1375
CVE ID: CVE-2021-21948 State: PUBLISHED Published: 2022-04-14T19:56:01.852Z Last Updated: 2025-04-15T19:08:34.692Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AnyCubic, Chitubox Products: Chitubox AnyCubic Plugin, Chitubox Basic Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. A specially-crafted GF file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1376
CVE ID: CVE-2021-21949 State: PUBLISHED Published: 2022-04-14T19:56:03.853Z Last Updated: 2025-04-15T19:08:27.417Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-129 Description: An improper array index validation vulnerability exists in the JPEG-JFIF Scan header parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to an out-of-bounds write and potential code exectuion. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_repor
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1377
CVE ID: CVE-2021-21950 State: PUBLISHED Published: 2021-12-08T21:28:18 Last Updated: 2024-08-03T18:30:23.587Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Anker Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function recv_server_device_response_msg_process. A specially-crafted network packet can lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1378
CVE ID: CVE-2021-21951 State: PUBLISHED Published: 2021-12-08T21:28:15 Last Updated: 2024-08-03T18:30:23.655Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Anker Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function read_udp_push_config_file. A specially-crafted network packet can lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1378
CVE ID: CVE-2021-21952 State: PUBLISHED Published: 2021-12-22T18:07:16 Last Updated: 2024-08-03T18:30:23.628Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: n/a Products: Anker" Problem Types: CWE-288 Description: An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1379
CVE ID: CVE-2021-21953 State: PUBLISHED Published: 2021-12-22T18:07:17 Last Updated: 2024-08-03T18:30:23.526Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: n/a Products: Anker Problem Types: CWE-300 Description: An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1380
CVE ID: CVE-2021-21954 State: PUBLISHED Published: 2021-12-09T15:32:38 Last Updated: 2024-08-03T18:30:23.653Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Anker Problem Types: CWE-78 Description: A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1381
CVE ID: CVE-2021-21955 State: PUBLISHED Published: 2021-12-09T15:32:43 Last Updated: 2024-08-03T18:30:23.598Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: n/a Products: Anker Problem Types: CWE-334 Description: An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1382
CVE ID: CVE-2021-21956 State: PUBLISHED Published: 2022-04-14T19:56:05.446Z Last Updated: 2025-04-15T19:08:21.054Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: CloudLinux Inc Products: Imunify360 Problem Types: CWE-502 Description: A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potential arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1383
CVE ID: CVE-2021-21957 State: PUBLISHED Published: 2021-12-08T21:29:57 Last Updated: 2024-08-03T18:30:23.591Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Dream Report Problem Types: CWE-276 Description: A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1384
CVE ID: CVE-2021-21958 State: PUBLISHED Published: 2022-02-16T16:38:31.000Z Last Updated: 2025-04-15T19:10:05.119Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Hancom Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and potential arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALO
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1386
CVE ID: CVE-2021-21959 State: PUBLISHED Published: 2022-02-04T22:29:09.000Z Last Updated: 2025-04-15T19:10:31.605Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-295 Description: A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1388
CVE ID: CVE-2021-21960 State: PUBLISHED Published: 2022-02-04T22:29:03.000Z Last Updated: 2025-04-15T19:11:12.487Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389
CVE ID: CVE-2021-21961 State: PUBLISHED Published: 2022-02-04T22:29:04.000Z Last Updated: 2025-04-15T19:11:05.626Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389
CVE ID: CVE-2021-21962 State: PUBLISHED Published: 2022-02-04T22:29:11.000Z Last Updated: 2025-04-15T19:10:13.647Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabi
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1390
CVE ID: CVE-2021-21963 State: PUBLISHED Published: 2022-02-04T22:29:02.000Z Last Updated: 2025-04-15T19:11:26.460Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: Sealevel Problem Types: CWE-311 Description: An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_repo
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1391
CVE ID: CVE-2021-21964 State: PUBLISHED Published: 2022-02-04T22:29:05.000Z Last Updated: 2025-04-15T19:10:57.878Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-284 Description: A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392
CVE ID: CVE-2021-21965 State: PUBLISHED Published: 2022-02-04T22:29:05.000Z Last Updated: 2025-04-15T19:10:51.323Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-284 Description: A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392
CVE ID: CVE-2021-21966 State: PUBLISHED Published: 2022-02-16T16:38:32 Last Updated: 2024-08-03T18:30:23.660Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Texas Instruments Problem Types: CWE-457 Description: An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1393
CVE ID: CVE-2021-21967 State: PUBLISHED Published: 2022-04-14T19:56:06.861Z Last Updated: 2025-04-15T19:08:14.098Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Sealevel Systems, Inc. Products: SeaConnect 370W Problem Types: CWE-120 Description: An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_report
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1394
CVE ID: CVE-2021-21968 State: PUBLISHED Published: 2022-02-04T22:29:10.000Z Last Updated: 2025-04-15T19:10:23.114Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Sealevel Problem Types: CWE-20 Description: A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1395
CVE ID: CVE-2021-21969 State: PUBLISHED Published: 2022-02-04T22:29:00.000Z Last Updated: 2025-04-15T19:11:38.376Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Sealevel" Problem Types: CWE-120 Description: An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [4] the json_object_get_string to populate the p_payload global variable. The p_payload is only 0x100 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the jso
age could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396
CVE ID: CVE-2021-21970 State: PUBLISHED Published: 2022-02-04T22:29:01.000Z Last Updated: 2025-04-15T19:11:32.563Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Sealevel Problem Types: CWE-120 Description: An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [3] the json_object_get_string to populate the p_name global variable. The p_name is only 0x80 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s valu
d be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396
CVE ID: CVE-2021-21971 State: PUBLISHED Published: 2022-02-04T22:29:02.000Z Last Updated: 2025-04-15T19:11:19.375Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Sealevel Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1406
CVE ID: CVE-2021-21972 State: PUBLISHED Published: 2021-02-24T16:42:05.000Z Last Updated: 2025-10-21T23:25:54.005Z Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: Remote code execution vulnerability Description: The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.
e 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2021-0002.html - http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html - http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html - http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html
CVE ID: CVE-2021-21973 State: PUBLISHED Published: 2021-02-24T16:42:02.000Z Last Updated: 2025-10-21T23:25:54.167Z Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: SSRF vulnerability Description: The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before
.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
CVE ID: CVE-2021-21974 State: PUBLISHED Published: 2021-02-24T16:57:33 Last Updated: 2024-08-03T18:30:23.578Z Vendors: n/a Products: VMware ESXi, VMware Cloud Foundation Problem Types: OpenSLP heap-overflow vulnerability Description: OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-
ution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0002.html - https://www.zerodayinitiative.com/advisories/ZDI-21-250/ - http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html
CVE ID: CVE-2021-21975 State: PUBLISHED Published: 2021-03-31T17:51:51.000Z Last Updated: 2025-10-21T23:25:50.479Z Vendors: n/a Products: VMware vRealize Operations Problem Types: Server Side Request Forgery Description: Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2021-0004.html - http://packetstormsecurity.com/files/162349/VMware-vRealiz
ps://www.vmware.com/security/advisories/VMSA-2021-0004.html - http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
CVE ID: CVE-2021-21976 State: PUBLISHED Published: 2021-02-11T20:34:45 Last Updated: 2024-08-03T18:30:23.449Z Vendors: n/a Products: vSphere Replication Problem Types: Authenticated command injection Description: vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0001.html