Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38167 State: PUBLISHED Published: 2021-08-07T18:00:36 Last Updated: 2024-08-04T01:37:15.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hap-wi/roxy-wi/issues/285
CVE ID: CVE-2021-38168 State: PUBLISHED Published: 2021-08-07T18:00:54 Last Updated: 2024-08-04T01:37:16.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hap-wi/roxy-wi/issues/285
CVE ID: CVE-2021-38169 State: PUBLISHED Published: 2021-08-07T18:00:45 Last Updated: 2024-08-04T01:37:15.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hap-wi/roxy-wi/issues/285
CVE ID: CVE-2021-38171 State: PUBLISHED Published: 2021-08-21T00:00:00 Last Updated: 2024-08-04T01:37:16.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.ffmpeg.org/project/ffmpeg/patch/AS8P193MB12542A86E22F8207EC971930B6F19%40AS8P193MB1254.EURP193.PROD.OUTLOOK.COM/ - https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 - https://www.debian.org/security/2021/dsa-4990 - https:/
/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 - https://www.debian.org/security/2021/dsa-4990 - https://www.debian.org/security/2021/dsa-4998 - https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html - https://security.gentoo.org/glsa/202312-14
CVE ID: CVE-2021-38172 State: PUBLISHED Published: 2022-02-05T17:26:21 Last Updated: 2024-08-04T01:37:16.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.) Additional Analyst Notes: - CVE Program Container: References: - https://packages.qa.debian.org/p/perm.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993019 - https://lists.debian.org/debian-med/2021/08/msg00016.html - https://tracker.debian.org/pkg/perm - https://salsa.debian.org/med-team/perm/-/commits/master/
CVE ID: CVE-2021-38173 State: PUBLISHED Published: 2021-08-07T18:58:19 Last Updated: 2024-08-04T01:37:15.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/digint/btrbk/commit/58212de771c381cd4fa05625927080bf264e9584 - https://github.com/digint/btrbk/blob/master/ChangeLog - https://lists.debian.org/debian-lts-announce/2021/09/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM7GL
9/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM7GLTUN5YS4KE2RNBX732EAMVVGNEX3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP2T32JMENJFRP2HWXR7FTTZVRTTPECL/
CVE ID: CVE-2021-38174 State: PUBLISHED Published: 2021-09-14T11:25:02 Last Updated: 2024-08-04T01:37:15.770Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/30877
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3087791
CVE ID: CVE-2021-38175 State: PUBLISHED Published: 2021-09-14T11:21:42 Last Updated: 2024-08-04T01:37:16.309Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP SE Products: SAP Analysis for Microsoft Office Problem Types: Information Disclosure Description: SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change information in the current system without user interaction. The attack would not lead to an impact on the availability of the system, but there would be an impact on integrity and confidentiality. Additional Analyst Notes: - CVE Program Container: Referen
ut there would be an impact on integrity and confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3082500
CVE ID: CVE-2021-38176 State: PUBLISHED Published: 2021-09-14T11:19:07 Last Updated: 2024-08-04T01:37:16.300Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP S/4HANA, SAP LT Replication Server, SAP LTRS for S/4HANA, SAP Test Data Migration Server, SAP Landscape Transformation Problem Types: Improper Input Sanitization Description: Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compro
inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3089831
CVE ID: CVE-2021-38177 State: PUBLISHED Published: 2021-09-14T11:24:27 Last Updated: 2024-08-04T01:37:16.323Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP CommonCryptoLib Problem Types: Null Pointer Dereference Description: SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious data in the HTTP requests over the network, this causes the SAP application to crash and has high impact on the availability of the SAP system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pa
Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3051787 - http://seclists.org/fulldisclosure/2022/Jan/74 - http://packetstormsecurity.com/files/165749/SAP-CommonCryptoLib-Null-Pointer-Dereference.html
CVE ID: CVE-2021-38178 State: PUBLISHED Published: 2021-10-12T14:03:34 Last Updated: 2024-08-04T01:37:15.889Z Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: Improper Authorization Description: The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data. Additional Analyst Notes: - CVE Program C
e the confidentiality, integrity, and availability of the system and its data. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - https://launchpad.support.sap.com/#/notes/3097887
CVE ID: CVE-2021-38179 State: PUBLISHED Published: 2021-10-12T14:03:06 Last Updated: 2024-08-04T01:37:16.482Z Vendors: SAP SE Products: SAP Business One Problem Types: Information Disclosure Description: Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3074819 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
CVE ID: CVE-2021-38180 State: PUBLISHED Published: 2021-10-12T14:03:41 Last Updated: 2024-08-04T01:37:15.903Z Vendors: SAP SE Products: SAP Business One Problem Types: CWE-1236 Description: SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169
Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - https://launchpad.support.sap.com/#/notes/3079427
CVE ID: CVE-2021-38181 State: PUBLISHED Published: 2021-10-12T14:03:13 Last Updated: 2024-08-04T01:37:15.601Z Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: Denial of Service Description: SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3080710 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
CVE ID: CVE-2021-38182 State: PUBLISHED Published: 2021-12-14T15:44:13 Last Updated: 2024-08-04T01:37:16.116Z Vendors: SAP SE Products: Kyma Problem Types: Header Manipulation Description: Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the cluster. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 - https://github.com/kyma-project/kyma/security/advisories/GHSA-2vjp-5q24-hqjv
CVE ID: CVE-2021-38183 State: PUBLISHED Published: 2021-10-12T14:04:07 Last Updated: 2024-08-04T01:37:16.304Z Vendors: SAP SE Products: SAP NetWeaver Problem Types: Cross Site Scripting Description: SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - https://launchpad.support.sap.com/#
References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - https://launchpad.support.sap.com/#/notes/3084937
CVE ID: CVE-2021-38185 State: PUBLISHED Published: 2021-08-07T00:00:00.000Z Last Updated: 2025-06-09T15:11:29.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fangqyi/cpiopwn - https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html - https://lists.gnu.o
s://github.com/fangqyi/cpiopwn - https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html - https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.html - https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b - https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
CVE ID: CVE-2021-38186 State: PUBLISHED Published: 2021-08-08T05:10:53 Last Updated: 2024-08-04T01:37:15.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0063.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/comrak/RUSTSEC-2021-0063.md
CVE ID: CVE-2021-38187 State: PUBLISHED Published: 2021-08-08T05:10:41 Last Updated: 2024-08-04T01:37:16.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0065.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/anymap/RUSTSEC-2021-0065.md
CVE ID: CVE-2021-38188 State: PUBLISHED Published: 2021-08-08T05:10:26 Last Updated: 2024-08-04T01:37:16.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0068.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/iced-x86/RUSTSEC-2021-0068.md
CVE ID: CVE-2021-38189 State: PUBLISHED Published: 2021-08-08T05:10:12 Last Updated: 2024-08-04T01:37:15.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0069.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md
CVE ID: CVE-2021-38190 State: PUBLISHED Published: 2021-08-08T05:09:59 Last Updated: 2024-08-04T01:37:16.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0070.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nalgebra/RUSTSEC-2021-0070.md
CVE ID: CVE-2021-38191 State: PUBLISHED Published: 2021-08-08T05:09:27 Last Updated: 2024-08-04T01:37:16.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0072.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0072.md
CVE ID: CVE-2021-38192 State: PUBLISHED Published: 2021-08-08T05:09:14 Last Updated: 2024-08-04T01:37:16.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0073.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/prost-types/RUSTSEC-2021-0073.md
CVE ID: CVE-2021-38193 State: PUBLISHED Published: 2021-08-08T05:09:01 Last Updated: 2024-08-04T01:37:16.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0074.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ammonia/RUSTSEC-2021-0074.md
CVE ID: CVE-2021-38194 State: PUBLISHED Published: 2021-08-08T05:08:44 Last Updated: 2024-08-04T01:37:16.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0075.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ark-r1cs-std/RUSTSEC-2021-0075.md
CVE ID: CVE-2021-38195 State: PUBLISHED Published: 2021-08-08T05:07:36 Last Updated: 2024-08-04T01:37:16.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0076.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsecp256k1/RUSTSEC-2021-0076.md
CVE ID: CVE-2021-38196 State: PUBLISHED Published: 2021-08-08T05:07:14 Last Updated: 2024-08-04T01:37:16.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0077.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/better-macro/RUSTSEC-2021-0077.md
CVE ID: CVE-2021-38197 State: PUBLISHED Published: 2021-08-08T15:18:17 Last Updated: 2024-08-04T01:37:16.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gen2brain/go-unarr/issues/21
CVE ID: CVE-2021-38198 State: PUBLISHED Published: 2021-08-08T19:28:12 Last Updated: 2024-08-04T01:37:15.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/b1bd5cba3306691c771d558e94baa73e8b0b96b7 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.11 - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2021-38199 State: PUBLISHED Published: 2021-08-08T19:27:50 Last Updated: 2024-08-04T01:37:16.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 - https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c - https://security.netapp.com/advisory/ntap-20210902-
com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c - https://security.netapp.com/advisory/ntap-20210902-0010/ - https://www.debian.org/security/2021/dsa-4978 - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2021-38200 State: PUBLISHED Published: 2021-08-08T19:27:29 Last Updated: 2024-08-04T01:37:16.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/60b7ed54a41b550d50caf7f2418db4a7e75b5bdc - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13
CVE ID: CVE-2021-38201 State: PUBLISHED Published: 2021-08-08T19:26:54 Last Updated: 2024-08-04T01:37:16.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 - https://github.com/torvalds/linux/commit/6d1c0f3d28f98ea2736128ed3e46821496dc3a8c - https://security.netapp.com/advisory/ntap-20210902-0010/
CVE ID: CVE-2021-38202 State: PUBLISHED Published: 2021-08-08T19:25:59 Last Updated: 2024-08-04T01:37:16.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 - https://github.com/torvalds/linux/commit/7b08cf62b1239a4322427d677ea9363f0ab677c6 - https://security.netapp.com/advisory/ntap-20210902-0010/
CVE ID: CVE-2021-38203 State: PUBLISHED Published: 2021-08-08T19:25:31 Last Updated: 2024-08-04T01:37:16.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 - https://github.com/torvalds/linux/commit/1cb3db1cf383a3c7dbda1aa0ce748b0958759947 - https://security.netapp.com/advisory/ntap-20210902-0010/