Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-42735 State: PUBLISHED Published: 2022-06-15T19:45:25.915Z Last Updated: 2025-04-23T18:12:28.551Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Problem Types: CWE-788 Description: Adobe Photoshop version 22.5.1 (and earlier versions ) is affected by an Access of Memory Location After End of Buffer vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb21-109.html
CVE ID: CVE-2021-42737 State: PUBLISHED Published: 2021-11-22T15:23:30.541Z Last Updated: 2025-04-23T19:19:10.794Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Prelude Problem Types: CWE-788 Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2021-42738 State: PUBLISHED Published: 2021-11-22T15:25:13.415Z Last Updated: 2025-04-23T19:19:04.189Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Prelude Problem Types: CWE-788 Description: Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2021-42739 State: PUBLISHED Published: 2021-10-20T00:00:00 Last Updated: 2024-08-04T03:38:50.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ%40mwanda/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e - https://seclists.org/oss-sec/2021/q2/46 - https://bugzilla.redh
it/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e - https://seclists.org/oss-sec/2021/q2/46 - https://bugzilla.redhat.com/show_bug.cgi?id=1951739 - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.starwindsoftware.com/security/sw-20220804-0001/
CVE ID: CVE-2021-42740 State: PUBLISHED Published: 2021-10-21T14:46:08 Last Updated: 2024-08-04T03:38:50.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case lett
ad of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/shell-quote - https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173 - https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe
CVE ID: CVE-2021-42743 State: PUBLISHED Published: 2022-05-06T16:36:35 Last Updated: 2024-08-04T03:38:50.215Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-427 Description: A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0501.html
CVE ID: CVE-2021-42744 State: PUBLISHED Published: 2021-11-19T18:36:49 Last Updated: 2024-08-04T03:38:50.147Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Philips Products: MRI 1.5T, MRI 3T Problem Types: CWE-200 Description: Philips MRI 1.5T and MRI 3T Version 5.x.x exposes sensitive information to an actor not explicitly authorized to have access. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-313-01 - https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE ID: CVE-2021-42748 State: PUBLISHED Published: 2022-01-07T18:10:51 Last Updated: 2024-08-04T03:38:50.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API. Additional Analyst Notes: - CVE Program Container: References: - https://tekfused.com/tek/vulnerability-research/beaver-builder-vulnerabilities-visibility-conditional-logic-cve/ - https://docs.wpbeaverbuilder.com/beaver-builder/developer/conditionally-hidden-content/
CVE ID: CVE-2021-42749 State: PUBLISHED Published: 2022-01-07T18:09:22 Last Updated: 2024-08-04T03:38:50.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt field is not set. Additional Analyst Notes: - CVE Program Container: References: - https://tekfused.com/tek/vulnerability-research/beaver-builder-vulnerabilities-visibility-conditional-logic-cve/ - https://docs.wpbeaverbuilder.com/beaver-builder/developer/conditionally-hidden-content/
CVE ID: CVE-2021-42750 State: PUBLISHED Published: 2022-08-12T16:52:36 Last Updated: 2024-08-04T03:38:50.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thingsboard/thingsboard - https://packetstormsecurity.com/files/167999/Thingsboard-3.3.1-Cross-Site-Scripting.html
CVE ID: CVE-2021-42751 State: PUBLISHED Published: 2022-08-12T16:52:47 Last Updated: 2024-08-04T03:38:50.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thingsboard/thingsboard - https://packetstormsecurity.com/files/167999/Thingsboard-3.3.1-Cross-Site-Scripting.html
CVE ID: CVE-2021-42752 State: PUBLISHED Published: 2021-12-08T11:53:50 Last Updated: 2024-10-25T13:41:42.909Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-111
CVE ID: CVE-2021-42753 State: PUBLISHED Published: 2022-02-02T10:46:53 Last Updated: 2024-10-22T21:01:39.030Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in the device filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-158
CVE ID: CVE-2021-42754 State: PUBLISHED Published: 2021-11-02T18:56:19 Last Updated: 2024-10-25T13:43:40.845Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiClientMac Problem Types: Execute unauthorized code or commands Description: An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-079
CVE ID: CVE-2021-42755 State: PUBLISHED Published: 2022-07-18T16:35:20 Last Updated: 2024-08-04T03:38:50.211Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiSwitch, FortiRecorder, FortiVoiceEnterprise, FortiOS, FortiProxy Problem Types: Denial of service Description: An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below, 6.2.10 and below, 6.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhc
.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-21-155
CVE ID: CVE-2021-42756 State: PUBLISHED Published: 2023-02-16T18:05:39.442Z Last Updated: 2024-10-23T14:49:52.406Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-121 Description: Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forti
d HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-186
CVE ID: CVE-2021-42757 State: PUBLISHED Published: 2021-12-08T11:01:11 Last Updated: 2025-10-16T09:46:26.239Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiDDoS-F, FortiVoice, FortiProxy, FortiRecorder, FortiPortal, FortiMail, FortiAnalyzer, FortiNDR, FortiDDoS, FortiSwitch, FortiADC, FortiWeb, FortiManager Problem Types: CWE-120 Description: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Additional Analyst Notes: - CVE Prog
r to achieve arbitrary code execution via specially crafted command line arguments. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/advisory/FG-IR-21-173
CVE ID: CVE-2021-42758 State: PUBLISHED Published: 2021-12-08T10:53:03 Last Updated: 2024-10-25T13:42:26.199Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiWLC Problem Types: Improper access control Description: An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-200
CVE ID: CVE-2021-42759 State: PUBLISHED Published: 2021-12-09T09:22:21 Last Updated: 2024-10-25T13:37:11.103Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet Meru AP Problem Types: Execute unauthorized code or commands Description: A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or commands via crafted cli commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-004
CVE ID: CVE-2021-42760 State: PUBLISHED Published: 2021-12-08T11:31:41 Last Updated: 2024-10-25T13:41:54.810Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Information disclosure Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-129
CVE ID: CVE-2021-42761 State: PUBLISHED Published: 2023-02-16T18:05:36.868Z Last Updated: 2024-10-23T14:50:09.331Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-384 Description: A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
other users and possibly usurp their session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-214
CVE ID: CVE-2021-42762 State: PUBLISHED Published: 2021-10-20T18:15:59 Last Updated: 2024-08-04T03:38:50.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Additional Analyst Notes: - CVE Program Contai
cess remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q - https://bugs.webkit.org/show_bug.cgi?id=231479 - http://www.openwall.com/lists/oss-security/2021/10/26/9 - http://www.openwall.com/lists/oss-security/2021/10/27/1 - http://www.openwall.com/lists/oss-security/2021/10/27/2 - http://www.openwall.com/lists/oss-security/2021/10/27/4 - https://www.debian.org/security/2021/dsa-4995 - https://www.debian.org/security/2021/dsa-4996 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX
1/dsa-4996 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/
CVE ID: CVE-2021-42763 State: PUBLISHED Published: 2021-11-02T11:46:24 Last Updated: 2024-08-04T03:38:50.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/a
ainer: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2021-42764 State: PUBLISHED Published: 2021-10-20T19:28:20 Last Updated: 2024-08-04T03:38:50.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (delayed consensus decisions), and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/abs/2110.10086
CVE ID: CVE-2021-42765 State: PUBLISHED Published: 2021-10-20T19:28:04 Last Updated: 2024-08-04T03:38:50.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite stalling of consensus decisions). Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/abs/2110.10086
CVE ID: CVE-2021-42766 State: PUBLISHED Published: 2021-10-20T19:27:43 Last Updated: 2024-08-04T03:38:50.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service (long-range consensus chain reorganizations), even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an increase in the profits of individual validators. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/abs/2110.10086
CVE ID: CVE-2021-42767 State: PUBLISHED Published: 2022-03-01T01:31:21 Last Updated: 2024-08-04T03:38:50.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://neo4j.com - https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m
CVE ID: CVE-2021-42770 State: PUBLISHED Published: 2021-11-08T15:21:32 Last Updated: 2024-08-04T03:38:50.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. Additional Analyst Notes: - CVE Program Container: References: - https://cert.orange.com - https://opnsense.org/opnsense-21-7-4-released/ - https://github.com/orangecertcc/security-research/security/advisories/GHSA-r32j-xgg3-w2rw
CVE ID: CVE-2021-42771 State: PUBLISHED Published: 2021-10-20T20:05:35 Last Updated: 2024-08-04T03:38:50.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2021-14 - https://github.com/python-babel/babel/pull/782 - https://lists.debian.org/debian-lts/2021/10/msg00040.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html - https://www.debian.org/security/2021/dsa-5018
CVE ID: CVE-2021-42772 State: PUBLISHED Published: 2021-11-03T19:13:34 Last Updated: 2024-08-04T03:38:50.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote GetDumpFile command that could allow a user to attempt various attacks. In non-secure mode, the user is unauthenticated Additional Analyst Notes: - CVE Program Container: References: - https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE ID: CVE-2021-42773 State: PUBLISHED Published: 2021-11-12T01:19:42 Last Updated: 2024-08-04T03:38:50.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a user to retrieve an arbitrary file from a remote host with the GetDumpFile command. In non-secure mode, the user is unauthenticated. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager - https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf
CVE ID: CVE-2021-42774 State: PUBLISHED Published: 2021-11-12T01:17:10 Last Updated: 2024-08-04T03:38:50.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote firmware download feature that could allow remote unauthenticated users to perform various attacks. In non-secure mode, the user is unauthenticated. Additional Analyst Notes: - CVE Program Container: References: - https://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager - https://docs.broadcom.com/d
tps://www.broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager - https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf