Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41545 State: PUBLISHED Published: 2022-05-10T09:46:45 Last Updated: 2024-08-04T03:15:28.250Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-248 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). When the controller receives a specific BACnet protocol packet, an exception causes the BACnet communication function to go into a “out of work” state and could result in the controller going into a “factory reset” state. Additional Analyst Note
nto a “out of work” state and could result in the controller going into a “factory reset” state. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-662649.pdf
CVE ID: CVE-2021-41546 State: PUBLISHED Published: 2021-10-12T09:49:39 Last Updated: 2024-08-04T03:15:28.882Z Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-400 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions
M ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). Affected devices write crashdumps without checking if enough space is available on the filesystem. Once the crashdump fills the entire root filesystem, affected devices fail to boot successfully. An attacker can leverage this vulnerability to cause a permanent Denial-of-Service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/pr
t Denial-of-Service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-173565.pdf
CVE ID: CVE-2021-41547 State: PUBLISHED Published: 2021-12-14T12:06:36 Last Updated: 2024-08-04T03:15:28.522Z Vendors: Siemens Products: Teamcenter Active Workspace V4.3, Teamcenter Active Workspace V5.0, Teamcenter Active Workspace V5.1, Teamcenter Active Workspace V5.2 Problem Types: CWE-22 Description: A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Teamcenter Active Workspace V5.1 (All versions < V5.1.6), Teamcenter Active Workspace V5.2 (All versions < V5.2.3). The application contains an unsafe unzipping pattern that could lead to a zip path traversal attack. This could allow an
The application contains an unsafe unzipping pattern that could lead to a zip path traversal attack. This could allow and attacker to execute a remote shell with admin rights. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-133772.pdf
CVE ID: CVE-2021-41550 State: PUBLISHED Published: 2022-01-18T14:46:04 Last Updated: 2024-08-04T03:15:28.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code. Additional Analyst Notes: - CVE Program Container: References: - https://www.leostream.com/resource/leostream-connection-broker-9-0/ - https://leostream.com/wp-content/uploads/2018/11/Leostream_release_notes.pdf
CVE ID: CVE-2021-41551 State: PUBLISHED Published: 2022-01-18T14:45:57 Last Updated: 2024-08-04T03:15:28.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://www.leostream.com/resource/leostream-connection-broker-9-0/ - https://leostream.com/wp-content/uploads/2018/11/Leostream_release_notes.pdf
CVE ID: CVE-2021-41552 State: PUBLISHED Published: 2022-02-15T13:32:50 Last Updated: 2024-08-04T03:15:28.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://commscope.com - https://arris.my.salesforce.com/sfc/p/#30000000kUAL/a/4Q000000Raud/cRx46eSijpwhTpoeWSgB1dQehSMwFrLV1gurcqI35QY
CVE ID: CVE-2021-41553 State: PUBLISHED Published: 2021-10-05T15:06:19 Last Updated: 2024-08-04T03:15:29.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field.
simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020 Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam
CVE ID: CVE-2021-41554 State: PUBLISHED Published: 2021-10-05T15:00:28 Last Updated: 2024-08-04T03:15:28.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticate
ces, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officia
NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020 Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam
CVE ID: CVE-2021-41555 State: PUBLISHED Published: 2021-10-05T14:58:40 Last Updated: 2024-08-04T03:15:28.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are
tered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020 Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/redteam
CVE ID: CVE-2021-41556 State: PUBLISHED Published: 2022-07-28T20:41:36 Last Updated: 2024-08-04T03:15:28.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games tha
(for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4dd1a0dcf9b0bd98 - http://www.squirrel-lang.org/#download - https://blog.sonarsource.com/squirrel-vm-sandbox-escape/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BV7SJJ44AGAX4ILIVPREIXPJ2GOG3FKV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3FQILX7UUEERSDPMZP3MKGTMY2E7ESU/
CVE ID: CVE-2021-41557 State: PUBLISHED Published: 2021-12-15T06:07:40 Last Updated: 2024-08-04T03:15:29.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number. Additional Analyst Notes: - CVE Program Container: References: - https://www.sofico.global - http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.html
CVE ID: CVE-2021-41558 State: PUBLISHED Published: 2021-09-27T17:00:26 Last Updated: 2024-08-04T03:15:28.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pgaudit/set_user/releases/tag/REL3_0_0
CVE ID: CVE-2021-41559 State: PUBLISHED Published: 2022-06-28T21:27:23 Last Updated: 2024-08-04T03:15:29.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://github.com/silverstripe/silverstripe-framework/releases - https://www.silverstripe.org/download/security-releases/cve-2021-41559
CVE ID: CVE-2021-41560 State: PUBLISHED Published: 2021-12-15T06:36:00 Last Updated: 2024-08-04T03:15:28.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/isiDISag7CM - https://github.com/opencats/OpenCATS/commit/b1af3bde1f68bec1c703ad66a3e390f15ed8ebe1 - https://github.com/Nickguitar/RevCAT
CVE ID: CVE-2021-41561 State: PUBLISHED Published: 2021-12-20T11:20:11 Last Updated: 2024-08-04T03:15:29.260Z Vendors: Apache Software Foundation Products: Apache Parquet Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/1bjlscbqtfzl160hrm9lnpjpppp5z3zr - http://www.openwall.com/lists/oss-security/2021/12/20/1
CVE ID: CVE-2021-41562 State: PUBLISHED Published: 2021-11-03T20:27:10.199721Z Last Updated: 2024-09-16T22:26:02.478Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Snow Products: Snow Agent for Windows Problem Types: CWE-64 Description: A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://community.snowsoftware.com/s/group/0F91r000000QUhPCAW/news-updates
CVE ID: CVE-2021-41563 State: PUBLISHED Published: 2021-10-08T15:15:32.049531Z Last Updated: 2024-09-16T20:52:56.358Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Tad Products: Tad Book3 Problem Types: CWE-79 Description: Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5167-2defb-1.html
CVE ID: CVE-2021-41564 State: PUBLISHED Published: 2021-10-08T15:15:33.614356Z Last Updated: 2024-09-16T16:13:15.696Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Tad Products: Tad Honor Problem Types: CWE-285 Description: Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5168-52304-1.html
CVE ID: CVE-2021-41565 State: PUBLISHED Published: 2021-10-08T15:15:35.097411Z Last Updated: 2024-09-16T16:13:39.371Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Tad Products: TadTools Problem Types: CWE-79 Description: TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5169-327ef-1.html
CVE ID: CVE-2021-41566 State: PUBLISHED Published: 2021-10-08T15:15:36.568963Z Last Updated: 2024-09-17T03:33:55.956Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tad Products: TadTools Problem Types: CWE-434 Description: The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html
CVE ID: CVE-2021-41567 State: PUBLISHED Published: 2021-10-08T15:15:38.115694Z Last Updated: 2024-09-16T19:19:19.852Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Tad Products: Uploader Problem Types: CWE-79 Description: The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5171-64439-1.html
CVE ID: CVE-2021-41568 State: PUBLISHED Published: 2021-10-08T15:15:39.583042Z Last Updated: 2024-09-16T16:24:01.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Tad Products: Tad Web Problem Types: CWE-285 Description: Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5172-b012c-1.html
CVE ID: CVE-2021-41569 State: PUBLISHED Published: 2021-11-19T17:14:10 Last Updated: 2024-08-04T03:15:29.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the ho
to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS. Additional Analyst Notes: - CVE Program Container: References: - https://www.mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas - https://support.sas.com/kb/68/641.html
CVE ID: CVE-2021-41570 State: PUBLISHED Published: 2022-04-19T12:38:27 Last Updated: 2024-08-04T03:15:28.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/support/en_US/security - https://www.veritas.com/content/support/en_US/security/VTS22-007
CVE ID: CVE-2021-41571 State: PUBLISHED Published: 2022-02-01T12:40:53 Last Updated: 2024-08-04T03:15:29.204Z Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-863 Description: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the use
there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId - https://github.com/apache/pulsar/issues/11814 - https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr
CVE ID: CVE-2021-41573 State: PUBLISHED Published: 2021-09-29T17:50:13 Last Updated: 2024-08-04T03:15:29.210Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authe
been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link . Additional Analyst Notes: - CVE Program Container: References: - https://www.hitachi.com/hirt/security/index.html - https://www.hitachi.com/hirt/hitachi-sec/2021/602.html
CVE ID: CVE-2021-41574 State: REJECTED Published: N/A Last Updated: 2022-11-04T00:00:00 Description: No description available.
CVE ID: CVE-2021-41575 State: REJECTED Published: N/A Last Updated: 2022-11-04T00:00:00 Description: No description available.
CVE ID: CVE-2021-41576 State: REJECTED Published: N/A Last Updated: 2022-11-04T00:00:00 Description: No description available.
CVE ID: CVE-2021-41578 State: PUBLISHED Published: 2021-10-04T17:38:23 Last Updated: 2024-08-04T03:15:29.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_05.txt
CVE ID: CVE-2021-41579 State: PUBLISHED Published: 2021-10-04T17:32:16 Last Updated: 2024-08-04T03:15:29.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a victim to load a malicious els project file and use the play feature, then the attacker can bypass a consent popup and write arbitrary files to OS locations where the user has permission, leading to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jacob-baines/vuln_disclosure/blob/main/vuln_2021_04.txt
CVE ID: CVE-2021-41580 State: PUBLISHED Published: 2021-09-27T06:11:20 Last Updated: 2024-08-04T03:15:29.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability Additional Analyst Notes: - CVE Program Container: Referen
vendor does not consider this a passport-oauth2 vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jaredhanson/passport-oauth2/pull/144 - https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea - https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1
CVE ID: CVE-2021-41581 State: PUBLISHED Published: 2021-09-24T02:12:33 Last Updated: 2024-08-04T03:15:29.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libressl-portable/openbsd/issues/126