Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36088 State: PUBLISHED Published: 2021-07-01T02:50:19 Last Updated: 2024-08-04T00:47:43.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33750 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/fluent-bit/OSV-2021-702.yaml - https://github.com/fluent/fluent-bit/commit/22346a74c07ceb90296be872be2d53eb92252a54 - https://github.com/fluent/fluent-bit/pull/3453
CVE ID: CVE-2021-36089 State: PUBLISHED Published: 2021-07-01T02:50:42 Last Updated: 2024-08-04T00:47:43.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33544 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2021-677.yaml - https://github.com/GrokImageCompression/grok/releases
CVE ID: CVE-2021-36090 State: PUBLISHED Published: 2021-07-13T07:15:23 Last Updated: 2024-08-04T00:47:43.813Z Vendors: Apache Software Foundation Products: Apache Commons Compress Problem Types: CWE-130 Description: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. Additional Analyst Notes: - CVE Program Container: References: - https://commons.apache.org/proper/commons-compress/security-reports.html - https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f22055
che.org/proper/commons-compress/security-reports.html - https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/13/4 - https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E - https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/13/6 - https://lists.apache.org
12cafc9%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/13/6 - https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E - https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299
6059945%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnoti
apache.org%3E - https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E - https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org
https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E - https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696
25140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E - https://
s.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211022-0001/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-36091 State: PUBLISHED Published: 2021-07-26T04:25:41.820529Z Last Updated: 2024-09-16T17:59:18.697Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-200 Description: Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-14/ - https://lists.debian.org/debian-lts-announce/2023/08/msg0004
://otrs.com/release-notes/otrs-security-advisory-2021-14/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-36092 State: PUBLISHED Published: 2021-07-26T04:25:43.381697Z Last Updated: 2024-09-17T03:02:46.230Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-79 Description: It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-
versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-15/
CVE ID: CVE-2021-36093 State: PUBLISHED Published: 2021-09-06T13:15:24.049964Z Last Updated: 2024-09-16T20:36:38.524Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-185 Description: It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-adv
sions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-16/
CVE ID: CVE-2021-36094 State: PUBLISHED Published: 2021-09-06T13:15:25.712091Z Last Updated: 2024-09-16T19:09:09.574Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-79 Description: It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-17/
CVE ID: CVE-2021-36095 State: PUBLISHED Published: 2021-09-06T13:15:27.220553Z Last Updated: 2024-09-16T17:58:45.926Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-200 Description: Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-18/
CVE ID: CVE-2021-36096 State: PUBLISHED Published: 2021-09-06T14:50:11.706653Z Last Updated: 2024-09-16T18:34:20.846Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-200 Description: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-
tional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-10/
CVE ID: CVE-2021-36097 State: PUBLISHED Published: 2021-10-18T07:00:13.855031Z Last Updated: 2024-09-16T22:51:23.138Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-266 Description: Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-20/
CVE ID: CVE-2021-36100 State: PUBLISHED Published: 2022-03-21T09:15:24.697180Z Last Updated: 2024-09-17T02:00:46.987Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: OTRS AG Products: OTRS, SystemMonitoring, OTRSSTORM, ((OTRS)) Community Edition Problem Types: rce Description: Specially crafted string in OTRS system configuration can allow the execution of any system command. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-03/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-36121 State: PUBLISHED Published: 2021-07-13T13:58:58 Last Updated: 2024-08-04T00:47:43.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files to be written to arbitrary filesystem locations via ../ Directory Traversal on the Z: drive (a hard-coded drive letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITY\
letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITY\SYSTEM). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE ID: CVE-2021-36122 State: PUBLISHED Published: 2021-07-13T14:00:51 Last Updated: 2024-08-04T00:47:43.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject arbitrary arguments to 7z.exe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE ID: CVE-2021-36123 State: PUBLISHED Published: 2021-07-13T13:56:20 Last Updated: 2024-08-04T00:47:43.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on the server filesystems as well any files accessible via Universal Naming Convention (UNC) paths. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-
st Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE ID: CVE-2021-36124 State: PUBLISHED Published: 2021-07-13T13:57:33 Last Updated: 2024-08-04T00:47:43.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md
CVE ID: CVE-2021-36125 State: PUBLISHED Published: 2021-07-02T13:01:13 Last Updated: 2024-08-04T00:47:43.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T260865 - https://gerrit.wikimedia.org/r/q/I97d8b3236b5abed8ba9a9c4d3ab5050c2e782c22
CVE ID: CVE-2021-36126 State: PUBLISHED Published: 2021-07-02T13:01:05 Last Updated: 2024-08-04T00:47:43.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T284364 - https://gerrit.wikimedia.org/r/q/I9e9f44
VE Program Container: References: - https://phabricator.wikimedia.org/T284364 - https://gerrit.wikimedia.org/r/q/I9e9f44b7663e810de70fb9ac7f6760f83dd4895b
CVE ID: CVE-2021-36127 State: PUBLISHED Published: 2021-07-02T13:00:57 Last Updated: 2024-08-04T00:47:43.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T285190 - https://gerrit.wikimedia.org/r/q/I4e4dbcad61e1d4f6fd8b038bf63d19c69081a8ec
CVE ID: CVE-2021-36128 State: PUBLISHED Published: 2021-07-02T13:00:45 Last Updated: 2024-08-04T00:47:43.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implemented. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T281972 - https://gerrit.wikimedia.org/r/q/I3e65690695313380c798b62edfda726b6e374f89 - https://gerrit.wikimedia.org/r/q/I15d14c88a1e30df92c470bc191c4ee573172d4d1
CVE ID: CVE-2021-36129 State: PUBLISHED Published: 2021-07-02T13:00:38 Last Updated: 2024-08-04T00:47:43.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T282932 - https://gerrit.wikimedia.org/r/q/I3619a7e88c2eb979babb7b027d4fdbfabc0af792
CVE ID: CVE-2021-36130 State: PUBLISHED Published: 2021-07-02T13:00:25 Last Updated: 2024-08-04T00:47:43.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T281043 - https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3
CVE ID: CVE-2021-36131 State: PUBLISHED Published: 2021-07-02T13:00:06 Last Updated: 2024-08-04T00:47:43.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T281196 - https://gerrit.wikimedia.org/r/q/Ic312cc9b8463c8e7c3298a661abfcff2cc2332cb
CVE ID: CVE-2021-36132 State: PUBLISHED Published: 2021-07-02T12:59:57 Last Updated: 2024-08-04T00:47:43.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T280590 - https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bf
ces: - https://phabricator.wikimedia.org/T280590 - https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3
CVE ID: CVE-2021-36133 State: PUBLISHED Published: 2021-12-07T20:42:31 Last Updated: 2024-08-04T00:47:43.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt
CVE ID: CVE-2021-36134 State: PUBLISHED Published: 2021-09-27T16:15:41 Last Updated: 2024-08-04T00:47:43.841Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://www.mcafee.com/blogs/?p=127255&preview=true
CVE ID: CVE-2021-36143 State: PUBLISHED Published: 2021-07-02T21:25:09 Last Updated: 2024-08-04T00:47:43.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectacrn/acrn-hypervisor/commit/154fe59531c12b82e26d1b24b5531f5066d224f5
CVE ID: CVE-2021-36144 State: PUBLISHED Published: 2021-07-02T21:24:57 Last Updated: 2024-08-04T00:47:43.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectacrn/acrn-hypervisor/pull/6268/commits/dd88504804e186029f845a166dc5c31695e2cca2
CVE ID: CVE-2021-36145 State: PUBLISHED Published: 2021-07-02T21:24:48 Last Updated: 2024-08-04T00:47:43.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectacrn/acrn-hypervisor/pull/6058/commits/f880086ffe5423e67d968c8f8f665954786582ce
CVE ID: CVE-2021-36146 State: PUBLISHED Published: 2021-07-02T21:24:35 Last Updated: 2024-08-04T00:47:43.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectacrn/acrn-hypervisor/pull/6173/commits/330359921e2e4c2f3f3a10b5bab86942d63c4428