Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23998 State: PUBLISHED Published: 2021-06-24T13:25:26 Last Updated: 2024-08-03T19:14:10.049Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Secure Lock icon could have been spoofed Description: Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-14/ - https://www.mozilla.org/security/advisories/mfsa2021-16/ - https://www.mozilla.org/security/advisories/mfsa2021-15/ - https://
//www.mozilla.org/security/advisories/mfsa2021-16/ - https://www.mozilla.org/security/advisories/mfsa2021-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1667456
CVE ID: CVE-2021-23999 State: PUBLISHED Published: 2021-06-24T13:25:15 Last Updated: 2024-08-03T19:14:10.142Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Blob URLs may have been granted additional privileges Description: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-14/ - https://www.mozilla.org/security/advisories/m
: References: - https://www.mozilla.org/security/advisories/mfsa2021-14/ - https://www.mozilla.org/security/advisories/mfsa2021-16/ - https://www.mozilla.org/security/advisories/mfsa2021-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1691153
CVE ID: CVE-2021-24000 State: PUBLISHED Published: 2021-06-24T13:20:48 Last Updated: 2024-08-03T19:14:10.064Z Vendors: Mozilla Products: Firefox Problem Types: requestPointerLock() could be applied to a tab different from the visible tab Description: A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as &lt;input type="file"&gt;) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. Additional Analyst
d potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-16/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1694698
CVE ID: CVE-2021-24001 State: PUBLISHED Published: 2021-06-24T13:20:41 Last Updated: 2024-08-03T19:14:10.109Z Vendors: Mozilla Products: Firefox Problem Types: Testing code could have enabled session history manipulations by a compromised content process Description: A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-16/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1694727
CVE ID: CVE-2021-24002 State: PUBLISHED Published: 2021-06-24T13:20:35 Last Updated: 2024-08-03T19:14:10.061Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Arbitrary FTP command execution on FTP servers using an encoded URL Description: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-14/ - https://www.mozilla.org/s
VE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2021-14/ - https://www.mozilla.org/security/advisories/mfsa2021-16/ - https://www.mozilla.org/security/advisories/mfsa2021-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1702374
CVE ID: CVE-2021-24005 State: PUBLISHED Published: 2021-07-06T10:56:12 Last Updated: 2024-10-25T13:57:36.414Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortinet Products: FortiAuthenticator Problem Types: Information disclosure Description: Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-049
CVE ID: CVE-2021-24006 State: PUBLISHED Published: 2021-09-06T18:56:19 Last Updated: 2024-10-25T13:50:43.582Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Improper Access Control Description: An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-061
CVE ID: CVE-2021-24007 State: PUBLISHED Published: 2021-07-09T18:37:57 Last Updated: 2024-10-25T13:56:27.949Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Execute unauthorized code or commands Description: Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-012
CVE ID: CVE-2021-24008 State: PUBLISHED Published: 2025-03-28T10:13:32.120Z Last Updated: 2025-03-28T13:39:11.758Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiDDoS, FortiNDR, FortiDDoS-CM Problem Types: CWE-200 Description: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRec
version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-20-105
CVE ID: CVE-2021-24009 State: PUBLISHED Published: 2022-04-06T09:15:26 Last Updated: 2024-10-25T13:33:53.241Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiWAN Problem Types: Execute unauthorized code or commands Description: Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/p
ests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-060
CVE ID: CVE-2021-24010 State: PUBLISHED Published: 2021-08-04T14:57:06 Last Updated: 2024-10-25T13:53:39.351Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Improper Access Control Description: Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated user to obtain unauthorized access to files and data via specifially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-202
CVE ID: CVE-2021-24011 State: PUBLISHED Published: 2021-05-10T11:43:18 Last Updated: 2024-10-25T13:58:57.729Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Fortinet Products: Fortinet FortiNAC Problem Types: Escalation of privilege Description: A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-038
CVE ID: CVE-2021-24012 State: PUBLISHED Published: 2021-06-02T12:42:19 Last Updated: 2024-10-25T13:58:11.976Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Impersonation Description: An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-018
CVE ID: CVE-2021-24013 State: PUBLISHED Published: 2021-07-12T13:30:55 Last Updated: 2024-10-25T13:55:16.383Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Improper Access Control Description: Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-014
CVE ID: CVE-2021-24014 State: PUBLISHED Published: 2021-08-04T18:11:11 Last Updated: 2024-10-25T13:52:26.217Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Execute unauthorized code or commands Description: Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-209
CVE ID: CVE-2021-24015 State: PUBLISHED Published: 2021-07-12T13:25:53 Last Updated: 2024-10-25T13:55:27.566Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-021
CVE ID: CVE-2021-24016 State: PUBLISHED Published: 2021-09-30T15:18:38 Last Updated: 2024-10-25T13:49:57.964Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Execute unauthorized code or commands Description: An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.c
tim host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-190
CVE ID: CVE-2021-24017 State: PUBLISHED Published: 2021-09-30T15:21:03 Last Updated: 2024-10-25T13:49:47.782Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:H/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Improper access control Description: An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-189
CVE ID: CVE-2021-24018 State: PUBLISHED Published: 2021-08-04T14:52:50 Last Updated: 2024-10-25T13:53:50.372Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-046
CVE ID: CVE-2021-24019 State: PUBLISHED Published: 2021-10-06T09:41:10 Last Updated: 2024-10-22T21:02:02.463Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientEMS Problem Types: Escalation of privilege Description: An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://f
ypothetical attacks) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-072
CVE ID: CVE-2021-24020 State: PUBLISHED Published: 2021-07-09T18:17:26 Last Updated: 2024-10-25T13:57:25.857Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Improper Access Control Description: A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-027
CVE ID: CVE-2021-24021 State: PUBLISHED Published: 2021-10-06T09:45:59 Last Updated: 2024-10-25T13:48:55.991Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks. Addition
iew in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-098
CVE ID: CVE-2021-24022 State: PUBLISHED Published: 2021-07-20T10:32:49 Last Updated: 2024-10-25T13:54:50.579Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiAnalyzer, FortiManager Problem Types: denial of service, Remote Code Execution Description: A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
tem geoip-city` command with a large ip value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-194
CVE ID: CVE-2021-24023 State: PUBLISHED Published: 2021-06-03T10:30:30 Last Updated: 2024-10-25T13:57:48.472Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiAI Problem Types: Execute unauthorized code or commands Description: An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-033
CVE ID: CVE-2021-24024 State: PUBLISHED Published: 2021-04-12T14:12:48 Last Updated: 2024-10-25T13:59:21.201Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortinet Products: Fortinet FortiADCManager, FortiADC Problem Types: Information disclosure Description: A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-244
CVE ID: CVE-2021-24025 State: PUBLISHED Published: 2021-03-10T15:50:30 Last Updated: 2024-08-03T19:14:10.116Z Vendors: Facebook Products: HHVM Problem Types: CWE-122 Description: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit
Container: References: - https://hhvm.com/blog/2021/02/25/security-update.html - https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca
CVE ID: CVE-2021-24026 State: PUBLISHED Published: 2021-04-06T16:45:15 Last Updated: 2024-08-03T19:21:17.055Z Vendors: Facebook Products: WhatsApp Business for iOS, WhatsApp for iOS, WhatsApp Business for Android, WhatsApp for Android Problem Types: CWE-787 Description: A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2021/
CVE ID: CVE-2021-24027 State: PUBLISHED Published: 2021-04-06T16:45:15 Last Updated: 2024-08-03T19:21:17.148Z Vendors: Facebook Products: WhatsApp Business for Android, WhatsApp for Android Problem Types: CWE-524 Description: A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material. Additional Analyst Notes: - CVE Program Container: References: - https://www.whatsapp.com/security/advisories/2021/
CVE ID: CVE-2021-24028 State: PUBLISHED Published: 2021-04-13T23:20:13 Last Updated: 2024-08-03T19:21:17.258Z Vendors: Facebook Products: Facebook Thrift Problem Types: CWE-763 Description: An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/fbthrift/commit/bfda1efa547dce11a38592820916db01b05b9339 - https://www.facebook.com/security/advisories/cve-2021-24028
CVE ID: CVE-2021-24029 State: PUBLISHED Published: 2021-03-15T21:15:16 Last Updated: 2024-08-03T19:21:17.115Z Vendors: Facebook Products: mvfst, proxygen Problem Types: CWE-617 Description: A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee28
yst Notes: - CVE Program Container: References: - https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0 - https://www.facebook.com/security/advisories/cve-2021-24029
CVE ID: CVE-2021-24030 State: PUBLISHED Published: 2021-03-10T15:50:31 Last Updated: 2024-08-03T19:21:17.165Z Vendors: Facebook Products: Facebook Gameroom Problem Types: CWE-88 Description: The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2021-24030
CVE ID: CVE-2021-24031 State: PUBLISHED Published: 2021-03-04T20:15:21 Last Updated: 2024-08-03T19:21:17.205Z Vendors: Facebook Products: Zstandard Problem Types: CWE-277 Description: In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/zstd/issues/1630 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404 - https://www.facebook.com/security/advisories/cve-2021-24031