Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-4106 State: PUBLISHED Published: 2022-02-16T16:38:02.235485Z Last Updated: 2024-09-16T17:18:32.505Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SNOW Products: Snow Inventory Java Scanner Problem Types: CWE-691 Description: A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0 Additional Analyst Notes: - CVE Program Container: References: - https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV
CVE ID: CVE-2021-4107 State: PUBLISHED Published: 2021-12-14T14:20:13 Last Updated: 2024-08-03T17:16:04.223Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1d124520-cf29-4539-a0f3-6d041af7b5a8 - https://github.com/yetiforcecompany/yetiforcecrm/commit/a062d3d5fecb000db207a2ad8a446db97ad96b89
CVE ID: CVE-2021-4108 State: PUBLISHED Published: 2021-12-14T20:10:14 Last Updated: 2024-08-03T17:16:04.227Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5069a037-040e-4d77-8526-846e65edfaf4 - https://github.com/snipe/snipe-it/commit/9d5d1a9f9aae2c8baee48551185da5de0cdb62c2
CVE ID: CVE-2021-4110 State: PUBLISHED Published: 2021-12-15T04:40:10 Last Updated: 2024-08-03T17:16:04.173Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-476 Description: mruby is vulnerable to NULL Pointer Dereference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4ce5dc47-2512-4c87-8609-453adc8cad20 - https://github.com/mruby/mruby/commit/f5e10c5a79a17939af763b1dcf5232ce47e24a34
CVE ID: CVE-2021-4111 State: PUBLISHED Published: 2021-12-15T08:55:11 Last Updated: 2024-08-03T17:16:04.251Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-840 Description: yetiforcecrm is vulnerable to Business Logic Errors Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8afc8981-baff-4082-b640-be535b29eb9a - https://github.com/yetiforcecompany/yetiforcecrm/commit/c1ad7111a090adfcd5898af40724907adc987acf
CVE ID: CVE-2021-4112 State: PUBLISHED Published: 2022-08-25T19:35:45 Last Updated: 2024-08-03T17:16:04.236Z Vendors: n/a Products: ansible-tower Problem Types: CWE-552 Description: A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2028121 - https://access.redhat.com/security/cve/CVE-2021-4112
CVE ID: CVE-2021-4113 State: REJECTED Published: 2021-12-22T16:12:32 Last Updated: 2021-12-22T16:12:32 Description: No description available.
CVE ID: CVE-2021-4114 State: REJECTED Published: 2021-12-22T16:13:07 Last Updated: 2021-12-22T16:13:07 Description: No description available.
CVE ID: CVE-2021-4115 State: PUBLISHED Published: 2022-02-21T00:00:00 Last Updated: 2024-08-03T17:16:04.361Z Vendors: n/a Products: polkitd Problem Types: CWE-400 Description: There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2021-4115 - https://gitlab.freedesktop.org/polkit/polkit/-/issues/141 - https://gitlab.com/redhat/centos-stream/
cve/cve-2021-4115 - https://gitlab.freedesktop.org/polkit/polkit/-/issues/141 - https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGKWCBS6IDZYYDYM2WIWJM5BL7QQTWPF/ - https://www.oracle.com/security-alerts/cpujul2022.html - http://packetstormsecurity.com/files/172849/polkit-File-Descriptor-Exhaustion.html
CVE ID: CVE-2021-4116 State: PUBLISHED Published: 2021-12-15T13:35:11 Last Updated: 2024-08-03T17:16:04.235Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7561bae7-9053-4dc8-aa59-b71acfb1712c - https://github.com/yetiforcecompany/yetiforcecrm/commit/9cdb012ca64ff1f719f8120d5fd162cd5ef1013f
CVE ID: CVE-2021-4117 State: PUBLISHED Published: 2021-12-15T14:35:12 Last Updated: 2024-08-03T17:16:04.255Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-840 Description: yetiforcecrm is vulnerable to Business Logic Errors Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0b81e572-bdc9-4caf-aa02-81f3c7ad7c0a - https://github.com/yetiforcecompany/yetiforcecrm/commit/8dccd93442725f245b4b71986bbe6f4f48639239
CVE ID: CVE-2021-4118 State: PUBLISHED Published: 2021-12-23T17:15:11 Last Updated: 2024-08-03T17:16:04.234Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: pytorchlightning Products: pytorchlightning/pytorch-lightning Problem Types: CWE-502 Description: pytorch-lightning is vulnerable to Deserialization of Untrusted Data Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6 - https://github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34ace
CVE ID: CVE-2021-4119 State: PUBLISHED Published: 2021-12-15T17:25:10 Last Updated: 2024-08-03T17:16:04.251Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bookstackapp Products: bookstackapp/bookstack Problem Types: CWE-284 Description: bookstack is vulnerable to Improper Access Control Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/135f2d7d-ab0b-4351-99b9-889efac46fca - https://github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99
CVE ID: CVE-2021-4120 State: PUBLISHED Published: 2022-02-17T22:15:21 Last Updated: 2024-08-03T17:16:04.197Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: snapd Problem Types: CWE-20 Description: snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN
2.54.3+21.10.1 Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5292-1 - https://bugs.launchpad.net/snapd/+bug/1949368 - http://www.openwall.com/lists/oss-security/2022/02/18/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/
CVE ID: CVE-2021-4121 State: PUBLISHED Published: 2021-12-16T07:35:10 Last Updated: 2024-08-03T17:16:04.232Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6da878de-acdb-4b97-b9ff-9674c3f0881d - https://github.com/yetiforcecompany/yetiforcecrm/commit/6b5967198e43b6fbb3b2715b49c6cd5b12ce08c3
CVE ID: CVE-2021-4122 State: PUBLISHED Published: 2022-08-24T15:08:58 Last Updated: 2024-08-03T17:16:04.245Z Vendors: n/a Products: cryptsetup Problem Types: CWE-345 Description: It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2031859 - https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes - https://gitl
_bug.cgi?id=2031859 - https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes - https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c - https://bugzilla.redhat.com/show_bug.cgi?id=2032401 - https://access.redhat.com/security/cve/CVE-2021-4122
CVE ID: CVE-2021-4123 State: PUBLISHED Published: 2021-12-16T10:10:10 Last Updated: 2024-08-03T17:16:04.183Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-352 Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/52182545-fdd6-4d4f-9fba-25010f7f8cba - https://github.com/livehelperchat/livehelperchat/commit/2a98c69cf8899afb9a76d737527abb1dd96fa106
CVE ID: CVE-2021-4124 State: PUBLISHED Published: 2021-12-16T13:15:11 Last Updated: 2024-08-03T17:16:04.237Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: meetecho Products: meetecho/janus-gateway Problem Types: CWE-79 Description: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a6ca142e-60aa-4d6f-b231-5d1bcd1b7190 - https://github.com/meetecho/janus-gateway/commit/f62bba6513ec840761f2434b93168106c7c65a3d
CVE ID: CVE-2021-4125 State: PUBLISHED Published: 2022-08-24T15:09:17 Last Updated: 2024-08-03T17:16:04.248Z Vendors: n/a Products: kube-reporting/hive Problem Types: CWE-20 Description: It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2033121 - https://access.redhat.com/security/cve/CVE-2021-4125 - https://access.redhat.com/security/cve/CVE-2
bug.cgi?id=2033121 - https://access.redhat.com/security/cve/CVE-2021-4125 - https://access.redhat.com/security/cve/CVE-2021-44228 - https://access.redhat.com/security/cve/CVE-2021-45046 - https://github.com/kube-reporting/hive/pull/71 - https://github.com/kube-reporting/hive/pull/72 - https://github.com/kube-reporting/hive/pull/73
CVE ID: CVE-2021-4126 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:51:48.700Z Vendors: Mozilla Products: Thunderbird Problem Types: OpenPGP signature status doesn't consider additional message content Description: When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME p
the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status. This vulnerability affects Thunderbird < 91.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2021-55/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1732310
CVE ID: CVE-2021-4127 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:51:21.077Z Vendors: Mozilla Products: Thunderbird, Firefox ESR Problem Types: Angle graphics library out of date Description: An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2021-12/ - https://www.mozilla.org/security/advisories/mfsa2021-11/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1691547
CVE ID: CVE-2021-4128 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:58:19.476Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free in fullscreen objects on MacOS Description: When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.<br>*This bug only affects Firefox on MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.org/show_bu
nrichment: References: - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1735852
CVE ID: CVE-2021-4129 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:56:28.819Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 Description: Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0.
ploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2021-53/ - https://www.mozilla.org/security/advisories/mfsa2021-54/ - https://www.mozilla.org/security/advisories/mfsa2021-52/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421
CVE ID: CVE-2021-4130 State: PUBLISHED Published: 2021-12-18T04:40:10 Last Updated: 2024-08-03T17:16:04.169Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-352 Description: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ccf073cd-7f54-4d51-89f2-6b4a2e4ae81e - https://github.com/snipe/snipe-it/commit/9b2dd6522f214a3fbee6a4e32699104d0ea2b6ae
CVE ID: CVE-2021-4131 State: PUBLISHED Published: 2021-12-18T06:20:10 Last Updated: 2024-08-03T17:16:04.159Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-352 Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/52dfac87-4fd3-4dfb-83d2-d39916764d43 - https://github.com/livehelperchat/livehelperchat/commit/3b5d0a8a43595a7f05f2a81b76623a8d7e5ad19f
CVE ID: CVE-2021-4132 State: PUBLISHED Published: 2021-12-17T12:45:09 Last Updated: 2024-08-03T17:16:04.236Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-79 Description: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7eb80e7c-bb7a-478d-9760-0ea2fa9dc0c2 - https://github.com/livehelperchat/livehelperchat/commit/55b1e3bf62c564db7c919f5293ec1e755c2958d6
CVE ID: CVE-2021-4133 State: PUBLISHED Published: 2022-01-25T19:11:13 Last Updated: 2024-08-03T17:16:04.238Z Vendors: n/a Products: Keycloak Problem Types: CWE-863 Description: A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2033602 - https://github.com/keycloak/keycloak/issues/9247 - https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 - https://www.oracle.com/security-al
9247 - https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-4134 State: PUBLISHED Published: 2022-02-16T16:38:05.000Z Last Updated: 2025-01-31T19:04:19.198Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Fancy Product Designer Products: Fancy Product Designer Problem Types: CWE-89 Description: The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP
itive information, in versions up to and including 4.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4134 - https://support.fancyproductdesigner.com/support/discussions/topics/13000031264
CVE ID: CVE-2021-4135 State: PUBLISHED Published: 2022-07-14T19:30:19 Last Updated: 2024-08-03T17:16:04.239Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
CVE ID: CVE-2021-4136 State: PUBLISHED Published: 2021-12-19T17:00:10 Last Updated: 2024-08-03T17:16:04.242Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938 - https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https:
project.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/ - https://support.apple.com/kb/HT213183 - http://seclists.org/fulldisclosure/2022/Mar/29 - https://support.apple.com/kb/HT213256 - http://seclists.org/fulldisclosure/2022/May/35 - https://support.apple.com/kb/HT213343 - http://seclists.org/fulldisclosure/2022/Jul/14 - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2021-4138 State: PUBLISHED Published: 2022-05-02T22:08:07 Last Updated: 2024-08-03T17:16:04.258Z Vendors: Mozilla Products: geckodriver Problem Types: Fixed a DNS rebinding issues by enforcing a stricter Host header check. Description: Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/geckodriver/releases/tag/v0.30.0 - https://bugzilla.mozilla.org/show_bug.cgi?id=1652612
CVE ID: CVE-2021-4139 State: PUBLISHED Published: 2021-12-21T12:50:10 Last Updated: 2024-08-03T17:16:04.247Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6ec59e43-095f-4ba3-8b75-e92250da8e3a - https://github.com/pimcore/pimcore/commit/d5c3e876d910784000335061c3bd24d301351245
CVE ID: CVE-2021-4140 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:55:20.960Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Iframe sandbox bypass with XSLT Description: It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-01/ - https://www.mozilla.org/security/advisories/mfsa2022-02/ - https://www.mozilla.org/security/advisories/mfsa2022-03/ - https://bugzill
ozilla.org/security/advisories/mfsa2022-02/ - https://www.mozilla.org/security/advisories/mfsa2022-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1746720
CVE ID: CVE-2021-4141 State: REJECTED Published: 2022-08-25T17:23:25 Last Updated: 2022-08-25T17:23:25 Description: No description available.
CVE ID: CVE-2021-4142 State: PUBLISHED Published: 2022-08-24T15:09:56 Last Updated: 2024-08-03T17:16:04.280Z Vendors: n/a Products: candlepin Problem Types: CWE-639 Description: The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2034346 - https://access.redhat.com/security/cve/CVE-2021-4142 - https://github.com/candlepin/candlepin/pull/3199 - https://github.com/candlepin/candlepin/pull/3197 - https://github.com/candlepin/c