Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3710 State: PUBLISHED Published: 2021-10-01T02:35:22.911127Z Last Updated: 2024-09-17T01:41:25.529Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Canonical Products: apport Problem Types: CWE-24 Description: An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3; Additional Analyst Notes: - CVE Program Container: References: - ht
7.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3; Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5077-1 - https://ubuntu.com/security/notices/USN-5077-2 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3710 - https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1933832
CVE ID: CVE-2021-3711 State: PUBLISHED Published: 2021-08-24T14:50:13.114745Z Last Updated: 2024-09-16T18:29:03.742Z Vendors: OpenSSL Products: OpenSSL Problem Types: Buffer overflow Description: In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug
ly sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other
n could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20210824.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46 - https://www.debian.org/security/2021/dsa-4963 - https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca
- https://www.debian.org/security/2021/dsa-4963 - https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/08/26/2 - https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E - https://security.netapp.com/advisory/ntap-20210827-0010/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.tenable.com/security/tns-2021-16 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211022-0003/ - https://www.tenable.com/security/tns-2022-02 - https://www
- https://security.netapp.com/advisory/ntap-20211022-0003/ - https://www.tenable.com/security/tns-2022-02 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://security.gentoo.org/glsa/202209-02 - https://security.gentoo.org/glsa/202210-02 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-3712 State: PUBLISHED Published: 2021-08-24T14:50:14.704334Z Last Updated: 2024-09-16T20:32:42.201Z Vendors: OpenSSL Products: OpenSSL Problem Types: Buffer overflow Description: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_ST
wn "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constru
STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_ge
ing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). Additional Analyst Notes: - CVE Program Container: Refe
1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20210824.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11 - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12 - https://www.debian.org/security/2021/dsa-4963 - https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/08/26/2 - https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9a
ww.openwall.com/lists/oss-security/2021/08/26/2 - https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E - https://security.netapp.com/advisory/ntap-20210827-0010/ - https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.tenable.com/security/tns-2021-16 - https://kc.mcafee.com/corporate/index?page=content&id=SB10366 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.tenable.com/security/tns-2022-02 - https://www.oracle.com/security-alerts/cpuapr2022.html
/cpujan2022.html - https://www.tenable.com/security/tns-2022-02 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf - https://security.gentoo.org/glsa/202209-02 - https://security.gentoo.org/glsa/202210-02 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-3713 State: PUBLISHED Published: 2021-08-25T18:40:48 Last Updated: 2024-08-03T17:01:08.104Z Vendors: n/a Products: QEMU Problem Types: CWE-787 Description: An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_b
process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1994640 - https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html - https://security.netapp.com/advisory/ntap-20210923-0006/ - https://www.debian.org/security/2021/dsa-4980 - https://security.gentoo.org/glsa/202208-27 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-3714 State: PUBLISHED Published: 2022-08-23T15:51:15 Last Updated: 2024-08-03T17:01:07.823Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/abs/2111.08553 - https://arxiv.org/pdf/2111.08553.pdf - https://bugzilla.redhat.com/show_bug
rences: - https://arxiv.org/abs/2111.08553 - https://arxiv.org/pdf/2111.08553.pdf - https://bugzilla.redhat.com/show_bug.cgi?id=1931327 - https://access.redhat.com/security/cve/CVE-2021-3714
CVE ID: CVE-2021-3715 State: PUBLISHED Published: 2022-03-02T22:17:14 Last Updated: 2024-08-03T17:01:07.986Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvald
Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef299cc3fa1a9e1288665a9fdc8bff55629fd359
CVE ID: CVE-2021-3716 State: PUBLISHED Published: 2022-03-02T22:19:03 Last Updated: 2024-08-03T17:01:08.173Z Vendors: n/a Products: nbdkit Problem Types: CWE-924 Description: A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/08/18/2 - https://list
st Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/08/18/2 - https://listman.redhat.com/archives/libguestfs/2021-August/msg00083.html - https://gitlab.com/nbdkit/nbdkit/-/commit/09a13dafb7bb3a38ab52eb5501cba786365ba7fd - https://gitlab.com/nbdkit/nbdkit/-/commit/6c5faac6a37077cf2366388a80862bb00616d0d8 - https://bugzilla.redhat.com/show_bug.cgi?id=1994695
CVE ID: CVE-2021-3717 State: PUBLISHED Published: 2022-05-24T18:18:43 Last Updated: 2024-08-03T17:01:08.330Z Vendors: n/a Products: wildfly Problem Types: CWE-552 Description: A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1991305 - https://security.netapp.com/advisory/ntap-20220804-0002/
CVE ID: CVE-2021-3718 State: PUBLISHED Published: 2021-11-12T22:05:34 Last Updated: 2024-08-03T17:01:08.300Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-232 Description: A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-72619
CVE ID: CVE-2021-3719 State: PUBLISHED Published: 2021-11-12T22:05:36 Last Updated: 2024-08-03T17:01:07.776Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkCentre and ThinkStation BIOS Problem Types: CWE-20 Description: A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-67440
CVE ID: CVE-2021-3720 State: PUBLISHED Published: 2021-11-12T22:05:38 Last Updated: 2024-08-03T17:01:08.293Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Legion Phone Pro (L79031), Legion Phone2 Pro (L70081) Problem Types: CWE-276 Description: An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_199217.html
CVE ID: CVE-2021-3721 State: PUBLISHED Published: 2022-04-22T20:30:32 Last Updated: 2024-08-03T17:01:08.308Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: PCManager Problem Types: CWE-787 Description: A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a blue screen error. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_200016.html
CVE ID: CVE-2021-3722 State: PUBLISHED Published: 2022-04-22T20:30:34 Last Updated: 2024-08-03T17:01:07.870Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: PCManager Problem Types: CWE-276 Description: A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-standard locations during installation. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_199218.html
CVE ID: CVE-2021-3723 State: PUBLISHED Published: 2021-11-12T22:05:39 Last Updated: 2024-08-03T17:01:07.696Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: IBM System x 3550 M3, IBM System x 3650 M3 Problem Types: CWE-78 Description: A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-66347
CVE ID: CVE-2021-3724 State: REJECTED Published: N/A Last Updated: 2023-02-12T00:00:00 Description: No description available.
CVE ID: CVE-2021-3725 State: PUBLISHED Published: 2021-11-30T09:30:14 Last Updated: 2024-08-03T17:01:08.297Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ohmyzsh Products: ohmyzsh/ohmyzsh Problem Types: CWE-78 Description: Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin. Additional Analyst Notes: -
command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb
CVE ID: CVE-2021-3726 State: PUBLISHED Published: 2021-11-30T09:30:15 Last Updated: 2024-08-03T17:01:08.345Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ohmyzsh Products: ohmyzsh/ohmyzsh Problem Types: CWE-78 Description: # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zs
cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac
CVE ID: CVE-2021-3727 State: PUBLISHED Published: 2021-11-30T09:30:17 Last Updated: 2024-08-03T17:01:08.331Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ohmyzsh Products: ohmyzsh/ohmyzsh Problem Types: CWE-78 Description: # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https:
n that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ohmyzsh/ohmyzsh/commit/72928432
CVE ID: CVE-2021-3728 State: PUBLISHED Published: 2021-08-23T12:41:58 Last Updated: 2024-08-03T17:01:08.427Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dd54c5a1-0d4a-4f02-a111-7ce4ddc67a4d - https://github.com/firefly-iii/firefly-iii/commit/14cdce113e0eb8090d09066fcd2b5cf03b5ac84e
CVE ID: CVE-2021-3729 State: PUBLISHED Published: 2021-08-23T12:41:59 Last Updated: 2024-08-03T17:01:07.813Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76 - https://github.com/firefly-iii/firefly-iii/commit/06d319cd71b7787aa919b3ba1ccf51e4ade67712
CVE ID: CVE-2021-3730 State: PUBLISHED Published: 2021-08-23T12:42:00 Last Updated: 2024-08-03T17:01:08.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-352 Description: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ea181323-51f8-46a2-a60f-6a401907feb7 - https://github.com/firefly-iii/firefly-iii/commit/f80178b1b2b7864d17500a131d570c353c9a26f6
CVE ID: CVE-2021-3731 State: PUBLISHED Published: 2021-08-23T12:42:01 Last Updated: 2024-08-03T17:01:07.699Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: ledgersmb Products: ledgersmb/ledgersmb Problem Types: CWE-1021 Description: LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a - https://ledgersmb.org/cve-2021-3731-clickjacking - https://www.debian.org/security/2021/dsa-4962
CVE ID: CVE-2021-3732 State: PUBLISHED Published: 2022-03-07T13:56:56 Last Updated: 2024-08-03T17:01:08.368Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1995249 - https://ubuntu.com/security/CVE-2021-3732 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=427215d85e8d1476da1a86b8d67aceb485eb3631 - https://github.com/torvald
scm/linux/kernel/git/torvalds/linux.git/commit/?id=427215d85e8d1476da1a86b8d67aceb485eb3631 - https://github.com/torvalds/linux/commit/427215d85e8d1476da1a86b8d67aceb485eb3631
CVE ID: CVE-2021-3733 State: PUBLISHED Published: 2022-03-07T00:00:00.000Z Last Updated: 2025-11-03T21:45:06.299Z Vendors: n/a Products: python Problem Types: CWE-400 Description: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue43075 - https://bugzi