Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3828 State: PUBLISHED Published: 2021-09-27T12:25:30 Last Updated: 2024-08-03T17:09:09.516Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nltk Products: nltk/nltk Problem Types: CWE-1333 Description: nltk is vulnerable to Inefficient Regular Expression Complexity Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32 - https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6
CVE ID: CVE-2021-3829 State: PUBLISHED Published: 2021-12-10T15:25:10 Last Updated: 2024-08-03T17:09:09.509Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: openwhyd Products: openwhyd/openwhyd Problem Types: CWE-601 Description: openwhyd is vulnerable to URL Redirection to Untrusted Site Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6b8acb0c-8b5d-461e-9b46-b1bfb5a8ccdf - https://github.com/openwhyd/openwhyd/commit/38707930103dcba49d89d993f56bebd346069640
CVE ID: CVE-2021-3830 State: PUBLISHED Published: 2021-09-26T08:15:14 Last Updated: 2024-08-03T17:09:09.611Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-79 Description: btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://github.com/btcpayserver/btcpayserver/commit/fc4e47cec608cc3dba24b19d0145ac69320b975e - https://huntr.dev/bounties/0fcdee5f-1f07-47ce-b650-ea8b4a7d35d8
CVE ID: CVE-2021-3831 State: PUBLISHED Published: 2021-12-14T10:50:10 Last Updated: 2024-08-03T17:09:09.511Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: gnuboard Products: gnuboard/gnuboard5 Problem Types: CWE-79 Description: gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/25775287-88cd-4f00-b978-692d627dff04 - https://github.com/gnuboard/gnuboard5/commit/2e81619ea87bc9c0b4a073d8df3c7693a6fdbf0d
CVE ID: CVE-2021-3832 State: PUBLISHED Published: 2021-10-07T13:33:19.417218Z Last Updated: 2024-09-17T02:36:13.483Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ártica Products: Integria IMS Problem Types: CWE-434 Description: Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/integria-ims-remote-code-execution - https://integriaims.com/en/services/updates/
CVE ID: CVE-2021-3833 State: PUBLISHED Published: 2021-10-07T15:10:07.808309Z Last Updated: 2024-09-16T23:46:25.217Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ártica Products: Integria IMS Problem Types: CWE-697 Description: Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords. Additional Analyst Notes: - CVE Program Container: References: - https://integriaims.com/en/services/updates/ - https://www.incibe.es/en/
t Notes: - CVE Program Container: References: - https://integriaims.com/en/services/updates/ - https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-incorrect-authorization
CVE ID: CVE-2021-3834 State: PUBLISHED Published: 2021-10-07T15:14:35.381205Z Last Updated: 2024-09-16T17:37:38.171Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Ártica Products: Integria IMS Problem Types: CWE-79 Description: Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://integriaims.com/en/services/updates/ - https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-vulnerable-cross-site-scripting-xss
CVE ID: CVE-2021-3835 State: PUBLISHED Published: 2022-02-07T22:00:12.211014Z Last Updated: 2024-09-17T00:15:57.193Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-122 Description: Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
CVE ID: CVE-2021-3836 State: PUBLISHED Published: 2021-12-14T15:20:13 Last Updated: 2024-08-03T17:09:09.506Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dbeaver Products: dbeaver/dbeaver Problem Types: CWE-611 Description: dbeaver is vulnerable to Improper Restriction of XML External Entity Reference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a98264fb-1930-4c7c-b774-af24c0175fd4 - https://github.com/dbeaver/dbeaver/commit/4debf8f25184b7283681ed3fb5e9e887d9d4fe22
CVE ID: CVE-2021-3837 State: PUBLISHED Published: 2022-01-03T15:05:11 Last Updated: 2024-08-03T17:09:09.679Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: openwhyd Products: openwhyd/openwhyd Problem Types: CWE-285 Description: openwhyd is vulnerable to Improper Authorization Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d66f90d6-1b5f-440d-8be6-cdffc9d4587e - https://github.com/openwhyd/openwhyd/commit/102a97bb082edc831cf35d27f9e5c4f55f10ae85
CVE ID: CVE-2021-3838 State: PUBLISHED Published: 2024-11-15T10:51:36.766Z Last Updated: 2024-11-18T14:41:07.247Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dompdf Products: dompdf/dompdf Problem Types: CWE-502 Description: DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP
PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e - https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
CVE ID: CVE-2021-3839 State: PUBLISHED Published: 2022-08-23T15:52:42 Last Updated: 2024-08-03T17:09:09.623Z Vendors: n/a Products: dpdk Problem Types: CWE-125 Description: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2025882 - https://access.redhat.com/security/cve/CVE-2021-3839 - https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5
CVE ID: CVE-2021-3840 State: PUBLISHED Published: 2021-11-12T22:05:54 Last Updated: 2024-08-03T17:09:09.548Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Antilles Products: Antilles Problem Types: CWE-427 Description: A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name pub
Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx
CVE ID: CVE-2021-3841 State: PUBLISHED Published: 2024-11-15T10:52:01.371Z Last Updated: 2024-11-20T22:36:05.302Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: sylius Products: sylius/sylius Problem Types: CWE-79 Description: sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1625506791178-Sylius/Sylius - https://github.com/sylius/sylius/commit/3da169e0c23e752974d742
https://huntr.com/bounties/1625506791178-Sylius/Sylius - https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc
CVE ID: CVE-2021-3842 State: PUBLISHED Published: 2022-01-04T14:50:09 Last Updated: 2024-08-03T17:09:09.531Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nltk Products: nltk/nltk Problem Types: CWE-1333 Description: nltk is vulnerable to Inefficient Regular Expression Complexity Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/761a761e-2be2-430a-8d92-6f74ffe9866a - https://github.com/nltk/nltk/commit/2a50a3edc9d35f57ae42a921c621edc160877f4d
CVE ID: CVE-2021-3843 State: PUBLISHED Published: 2021-11-12T22:05:56 Last Updated: 2024-08-03T17:09:09.580Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-20 Description: A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-72619
CVE ID: CVE-2021-3844 State: PUBLISHED Published: 2023-03-24T16:37:56.633Z Last Updated: 2025-02-19T20:27:19.666Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Rapid7 Products: InsightVM Problem Types: CWE-613 Description: Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and a
e password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.rapid7.com/insightvm/enable-insightvm-platform-login - https://www.cve.org/cverecord?id=CVE-2019-5638
CVE ID: CVE-2021-3845 State: PUBLISHED Published: 2022-01-04T16:35:09 Last Updated: 2024-08-03T17:09:09.449Z Vendors: netristv Products: netristv/ws-scrcpy Problem Types: CWE-73 Description: ws-scrcpy is vulnerable to External Control of File Name or Path Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dc7fc98f-4f4f-440a-b6f6-124a56ea36ef - https://github.com/netristv/ws-scrcpy/commit/e83cf65438bef83a3503b25358bba97bcc156fef
CVE ID: CVE-2021-3846 State: PUBLISHED Published: 2021-10-19T12:30:26 Last Updated: 2024-08-03T17:09:09.516Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-434 Description: firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5267ec1c-d204-40d2-bd4f-6c2dd495ee18 - https://github.com/firefly-iii/firefly-iii/commit/a85b6420c19ace35134f896e094e1971d8c7954b
CVE ID: CVE-2021-3847 State: PUBLISHED Published: 2022-04-01T22:17:29 Last Updated: 2024-08-03T17:09:09.608Z Vendors: n/a Products: kernel Problem Types: CWE-281 Description: An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2009704 - https://www.openwall.com/lists/oss-security/2021/10/14/3
CVE ID: CVE-2021-3848 State: PUBLISHED Published: 2021-10-06T09:50:57 Last Updated: 2024-08-03T17:09:09.607Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Arbitrary File Creation by Privliege Escalation Description: An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privi
-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000289183
CVE ID: CVE-2021-3849 State: PUBLISHED Published: 2022-04-22T21:10:11 Last Updated: 2024-08-03T17:09:09.602Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Fan Power Controller2 (FPC2), Lenovo System Management Module (SMM) Problem Types: CWE-288 Description: An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_sec
affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-72615
CVE ID: CVE-2021-3850 State: PUBLISHED Published: 2022-01-25T14:20:11 Last Updated: 2024-08-03T17:09:09.599Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: adodb Products: adodb/adodb Problem Types: CWE-305 Description: Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c - https://github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29 - https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html - https://www.debian.org/security/2022/dsa-5101
CVE ID: CVE-2021-3851 State: PUBLISHED Published: 2021-10-19T12:30:28 Last Updated: 2024-08-03T17:09:09.565Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-601 Description: firefly-iii is vulnerable to URL Redirection to Untrusted Site Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/549a1040-9b5e-420b-9b80-20700dd9d592 - https://github.com/firefly-iii/firefly-iii/commit/8662dfa4c0f71efef61c31dc015c6f723db8318d
CVE ID: CVE-2021-3852 State: PUBLISHED Published: 2022-01-12T10:15:11 Last Updated: 2024-08-03T17:09:09.536Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: weseek Products: weseek/growi Problem Types: CWE-639 Description: growi is vulnerable to Authorization Bypass Through User-Controlled Key Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d44def81-2834-4031-9037-e923975c3852 - https://github.com/weseek/growi/commit/863bfd7f622f413bd159b9446166fb1ce78ec863
CVE ID: CVE-2021-3853 State: PUBLISHED Published: 2022-01-17T11:25:09 Last Updated: 2024-08-03T17:09:09.541Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: chaskiq Products: chaskiq/chaskiq Problem Types: CWE-79 Description: chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d - https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345
CVE ID: CVE-2021-3854 State: PUBLISHED Published: 2023-03-02T11:01:05.232Z Last Updated: 2025-03-05T21:13:19.769Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Glox Technology Products: Useroam Hotspot Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0120
CVE ID: CVE-2021-3855 State: PUBLISHED Published: 2023-02-24T13:02:08.734Z Last Updated: 2025-03-11T15:43:13.116Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Liman Central Management System Products: Liman Central Management System Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.li
ore 1.8.3-462. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.liman.dev/baslangic/guvenlik - https://www.usom.gov.tr/bildirim/tr-23-0109
CVE ID: CVE-2021-3856 State: PUBLISHED Published: 2022-08-26T15:25:39 Last Updated: 2024-08-03T17:09:09.556Z Vendors: n/a Products: keycloak Problem Types: CWE-552 Description: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available. Additional Analyst Notes: - CVE Program Container: References: - https://issues.redhat.com/browse/KEYCLOAK-19422 - https://github.com/keycloak/keycloak/pull/8588 - https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda
s://github.com/keycloak/keycloak/pull/8588 - https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743 - https://bugzilla.redhat.com/show_bug.cgi?id=2010164 - https://access.redhat.com/security/cve/CVE-2021-3856
CVE ID: CVE-2021-3857 State: PUBLISHED Published: 2022-01-17T11:35:09 Last Updated: 2024-08-03T17:09:09.600Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: chaskiq Products: chaskiq/chaskiq Problem Types: CWE-79 Description: chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3 - https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0
CVE ID: CVE-2021-3858 State: PUBLISHED Published: 2021-10-19T12:30:29 Last Updated: 2024-08-03T17:09:09.586Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-352 Description: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a2fac2eb-100d-45b1-9ac7-71847c2f2b6b - https://github.com/snipe/snipe-it/commit/84c73aae5dcafa9529ceeeda6e8cdda5a42129c3
CVE ID: CVE-2021-3859 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-03T17:09:09.581Z Vendors: n/a Products: undertow Problem Types: CWE-214 Description: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2010378 - https://issues.redhat.com/browse/UNDERTOW-1979 - https://github.com/undertow-io/undertow/pull/1296 - https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 - https://access.redhat.com/secur
ttps://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 - https://access.redhat.com/security/cve/CVE-2021-3859 - https://security.netapp.com/advisory/ntap-20221201-0004/
CVE ID: CVE-2021-3860 State: PUBLISHED Published: 2021-12-20T00:00:00 Last Updated: 2024-11-18T19:58:54.966Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: JFrog Products: JFrog Artifactory Problem Types: CWE-89 Description: JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jfrog.com/confluence/display/JFROG/CVE-2021-3860%3A+Artifactory+Low+Privileged+Blind+SQL+Injection - http://packetstormsecurity.com/files/177
display/JFROG/CVE-2021-3860%3A+Artifactory+Low+Privileged+Blind+SQL+Injection - http://packetstormsecurity.com/files/177162/JFrog-Artifactory-SQL-Injection.html
CVE ID: CVE-2021-3861 State: PUBLISHED Published: 2022-02-07T22:00:13.805383Z Last Updated: 2024-09-16T16:18:17.167Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-122 Description: The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj