Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3950 State: PUBLISHED Published: 2021-11-19T12:10:10 Last Updated: 2024-08-03T17:09:09.863Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: django-helpdesk Products: django-helpdesk/django-helpdesk Problem Types: CWE-79 Description: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e - https://github.com/django-helpdesk/django-helpdesk/commit/04483bdac3b5196737516398b5ce0383875a5c60
CVE ID: CVE-2021-3956 State: PUBLISHED Published: 2022-05-18T16:10:24 Last Updated: 2024-08-03T17:09:09.619Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: XClarity Controller (XCC) Problem Types: CWE-863 Description: A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configurati
authenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-72074
CVE ID: CVE-2021-3957 State: PUBLISHED Published: 2021-11-19T12:00:11 Last Updated: 2024-08-03T17:09:09.758Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-352 Description: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5fa3098a-ba02-45e0-af56-645e34dbc691 - https://github.com/kevinpapst/kimai2/commit/6b49535b523dcd36ec59462ee4e67e2b3a9151f3
CVE ID: CVE-2021-3958 State: PUBLISHED Published: 2021-11-16T15:46:57.396925Z Last Updated: 2024-09-17T02:21:53.159Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ipack Automation Systems Products: Ipack SCADA Software Problem Types: CWE-89 Description: Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt
CVE ID: CVE-2021-3959 State: PUBLISHED Published: 2021-12-16T14:35:16.426143Z Last Updated: 2024-09-17T01:31:01.082Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Bitdefender Products: GravityZone Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3.8.272 Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-bitdefender-g
iner: References: - https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-bitdefender-gravityzone-update-server-in-relay-mode-va-10145
CVE ID: CVE-2021-3960 State: PUBLISHED Published: 2021-12-16T14:40:15.890326Z Last Updated: 2024-09-16T19:41:10.501Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Bitdefender Products: GravityZone Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272 Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/privilege-escalation-v
s: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-10146
CVE ID: CVE-2021-3961 State: PUBLISHED Published: 2021-11-19T11:55:10 Last Updated: 2024-08-03T17:09:09.671Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5987aed5-6613-4937-8a3e-d48009b7da10 - https://github.com/snipe/snipe-it/commit/7ce5993f5ae9d713a0955c2fd8e2dff7a7ce886e
CVE ID: CVE-2021-3962 State: PUBLISHED Published: 2021-11-19T16:11:30 Last Updated: 2024-08-03T17:09:09.683Z Vendors: n/a Products: ImageMagick Problem Types: CWE-416 Description: A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2023196 - https://github.com/ImageM
: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2023196 - https://github.com/ImageMagick/ImageMagick/commit/82775af03bbb10a0a1d0e15c0156c75673b4525e - https://github.com/ImageMagick/ImageMagick/issues/4446
CVE ID: CVE-2021-3963 State: PUBLISHED Published: 2021-11-19T11:50:10 Last Updated: 2024-08-03T17:09:09.612Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-352 Description: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3abf308b-7dbd-4864-b1a9-5c45b876def8 - https://github.com/kevinpapst/kimai2/commit/95796ab2560ad93f44068a88f0fad758c2053514
CVE ID: CVE-2021-3964 State: PUBLISHED Published: 2021-12-01T11:25:10 Last Updated: 2024-08-03T17:09:09.679Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: elgg Products: elgg/elgg Problem Types: CWE-639 Description: elgg is vulnerable to Authorization Bypass Through User-Controlled Key Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a4df45d6-b739-4299-967f-c960b569383a - https://github.com/elgg/elgg/commit/d9fcad76ee380ea17edd61d13d0f87828ea3f744
CVE ID: CVE-2021-3965 State: PUBLISHED Published: 2022-01-14T19:11:42 Last Updated: 2024-08-03T17:09:09.697Z Vendors: n/a Products: HP DesignJet Printer Problem Types: Insecure Direct Object Reference Description: Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5268198-5268230-16
CVE ID: CVE-2021-3966 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-09T18:29:11.461Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-122 Description: usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfxq-3w6x-fv2m
CVE ID: CVE-2021-3967 State: PUBLISHED Published: 2022-02-26T23:00:10 Last Updated: 2024-08-03T17:09:09.862Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: zulip Products: zulip/zulip Problem Types: CWE-284 Description: Improper Access Control in GitHub repository zulip/zulip prior to 4.10. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2928a625-0467-4a0a-b4e2-e27322786686 - https://github.com/zulip/zulip/commit/d5db254ca8167995a1654d1c45ffc74b2fade39a
CVE ID: CVE-2021-3968 State: PUBLISHED Published: 2021-11-19T11:40:12 Last Updated: 2024-08-03T17:09:09.784Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/00d62924-a7b4-4a61-ba29-acab2eaa1528 - https://github.com/vim/vim/commit/a062006b9de0b2947ab5fb376c6e67ef92a8cd69 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40l
oject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2021-3969 State: PUBLISHED Published: 2022-05-18T16:10:25 Last Updated: 2024-08-03T17:09:09.613Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: IMController Problem Types: CWE-367 Description: A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3that could allow a local attacker to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-75210
CVE ID: CVE-2021-3970 State: PUBLISHED Published: 2022-04-22T20:30:37 Last Updated: 2024-08-03T17:09:09.797Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook BIOS Problem Types: CWE-20 Description: A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-73440
CVE ID: CVE-2021-3971 State: PUBLISHED Published: 2022-04-22T20:30:38 Last Updated: 2024-08-03T17:09:09.596Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook BIOS Problem Types: CWE-489 Description: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-73440
CVE ID: CVE-2021-3972 State: PUBLISHED Published: 2022-04-22T20:30:40 Last Updated: 2024-08-03T17:09:09.723Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook BIOS Problem Types: CWE-489 Description: A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-73440
CVE ID: CVE-2021-3973 State: PUBLISHED Published: 2021-11-19T11:35:11 Last Updated: 2024-08-03T17:09:09.694Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ce6e8609-77c6-4e17-b9fc-a2e5abed052e - https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2021-3974 State: PUBLISHED Published: 2021-11-19T00:00:00 Last Updated: 2024-08-03T17:09:09.885Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: vim is vulnerable to Use After Free Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e402cb2c-8ec4-4828-a692-c95f8e0de6d4 - https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-3975 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T17:09:09.828Z Vendors: n/a Products: libvirt Problem Types: CWE-416 Description: A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bu
tack by causing the libvirt daemon to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2024326 - https://access.redhat.com/security/cve/CVE-2021-3975 - https://ubuntu.com/security/CVE-2021-3975 - https://github.com/libvirt/libvirt/commit/1ac703a7d0789e46833f4013a3876c2e3af18ec7 - https://security.netapp.com/advisory/ntap-20221201-0002/ - https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
CVE ID: CVE-2021-3976 State: PUBLISHED Published: 2021-11-19T10:35:10 Last Updated: 2024-08-03T17:09:09.628Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-352 Description: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0567048a-118c-42ec-9f94-b55533017406 - https://github.com/kevinpapst/kimai2/commit/b28e9c120c87222e21a238f1b03a609d6a5d506e
CVE ID: CVE-2021-3977 State: PUBLISHED Published: 2021-12-24T20:10:10 Last Updated: 2024-08-03T17:09:09.688Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: invoiceninja Products: invoiceninja/invoiceninja Problem Types: CWE-79 Description: invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde - https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f
CVE ID: CVE-2021-3978 State: PUBLISHED Published: 2025-01-29T10:00:53.237Z Last Updated: 2025-02-12T16:03:40.405Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Cloudflare Products: octorpki Problem Types: CWE-269 Description: When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation. Additional Analyst
vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3pqh-p72c-fj85
CVE ID: CVE-2021-3979 State: PUBLISHED Published: 2022-08-25T00:00:00.000Z Last Updated: 2025-11-03T18:08:00.683Z Vendors: n/a Products: ceph Problem Types: CWE-327 Description: A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2024788 - https://access.redhat.com/security/cve/CVE-2021-3979 - https://tracker.ceph.com/issues/54006 - https://github.com/ceph/ce
ttps://access.redhat.com/security/cve/CVE-2021-3979 - https://tracker.ceph.com/issues/54006 - https://github.com/ceph/ceph/pull/44765 - https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE ID: CVE-2021-3980 State: PUBLISHED Published: 2021-12-03T15:05:10 Last Updated: 2024-08-03T17:09:09.747Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: elgg Products: elgg/elgg Problem Types: CWE-359 Description: elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1f43f11e-4bd8-451f-a244-dc9541cdc0ac - https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126
CVE ID: CVE-2021-3981 State: PUBLISHED Published: 2022-03-08T14:02:15.000Z Last Updated: 2025-02-13T16:28:29.161Z Vendors: n/a Products: grub2 Problem Types: CWE-276 Description: A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in grub.cfg. This flaw affects grub2 2.06 and previous versions. This issue has been fixed in grub upstream but no version with the fix is currently released. Additional Analyst Notes: - CVE Program Container: References: - htt
but no version with the fix is currently released. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AI776L35DDYPCSAAJPJM3ZEQYSFZHBJX/ - https://bugzilla.redhat.com/show_bug.cgi?id=2024170 - https://security.gentoo.org/glsa/202209-12 - http://www.openwall.com/lists/oss-security/2024/01/15/3
CVE ID: CVE-2021-3982 State: PUBLISHED Published: 2022-04-29T00:00:00 Last Updated: 2024-08-03T17:09:09.635Z Vendors: n/a Products: gnome-shell Problem Types: CWE-273 Description: Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take advantage of the way CAP_SYS_NICE is currently implemented and eventually load code to increase its process scheduler priority leading to possible DoS of other services running in the same machine. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2284 - https://gitlab.gnome.org/GNOME/mutter/-/m
iner: References: - https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2284 - https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2060
CVE ID: CVE-2021-3983 State: PUBLISHED Published: 2021-12-01T11:15:12 Last Updated: 2024-08-03T17:09:09.686Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-79 Description: kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c96f3480-dccf-4cc2-99a4-d2b3a7462413 - https://github.com/kevinpapst/kimai2/commit/89bfa82c61da0d3639e4038e689e25467baac8a0
CVE ID: CVE-2021-3984 State: PUBLISHED Published: 2021-12-01T00:00:00 Last Updated: 2024-08-03T17:09:09.762Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b114b5a2-18e2-49f0-b350-15994d71426a - https://github.com/vim/vim/commit/2de9b7c7c8791da8853a9a7ca9c467867465b655 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https:
project.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2021-3985 State: PUBLISHED Published: 2021-12-01T11:05:11 Last Updated: 2024-08-03T17:09:09.862Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: kevinpapst Products: kevinpapst/kimai2 Problem Types: CWE-79 Description: kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/89d6c3de-efbd-4354-8cc8-46e999e4c5a4 - https://github.com/kevinpapst/kimai2/commit/76e09447c85e762882126b49626a4fe4d93fe8b5
CVE ID: CVE-2021-3986 State: PUBLISHED Published: 2024-11-15T10:52:21.551Z Last Updated: 2024-11-15T18:31:36.752Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-209 Description: A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix. Additional Analyst Notes: -