Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38204 State: PUBLISHED Published: 2021-08-08T19:25:01 Last Updated: 2024-08-04T01:37:16.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6 - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2021-38205 State: PUBLISHED Published: 2021-08-08T19:23:51 Last Updated: 2024-08-04T01:37:16.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3 - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-l
hangeLog-5.13.3 - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2021-38206 State: PUBLISHED Published: 2021-08-08T19:23:24 Last Updated: 2024-08-04T01:37:16.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13 - https://github.com/torvalds/linux/commit/bddc0c411a45d3718ac535a070f349be8eca8d48
CVE ID: CVE-2021-38207 State: PUBLISHED Published: 2021-08-08T19:22:47 Last Updated: 2024-08-04T01:37:16.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13 - https://github.com/torvalds/linux/commit/c364df2489b8ef2f5e3159b1dff1ff1fdb16040d - https://security.netapp.com/advisory/ntap-20210902-0007/
CVE ID: CVE-2021-38208 State: PUBLISHED Published: 2021-08-08T19:22:22 Last Updated: 2024-08-04T01:37:16.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10 - http://www.openwall.com/lists/oss-security/2021/08/17/1 - http://www.openwall.com/lists/o
ernel/v5.x/ChangeLog-5.12.10 - http://www.openwall.com/lists/oss-security/2021/08/17/1 - http://www.openwall.com/lists/oss-security/2021/08/17/2 - https://bugzilla.redhat.com/show_bug.cgi?id=1992810 - http://www.openwall.com/lists/oss-security/2021/08/24/2
CVE ID: CVE-2021-38209 State: PUBLISHED Published: 2021-08-08T19:21:00 Last Updated: 2024-08-04T01:37:16.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
CVE ID: CVE-2021-38217 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-08T20:20:26.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BigTiger2020/SEMCMS/blob/main/semcms-1.2-sql-2.md
CVE ID: CVE-2021-38221 State: PUBLISHED Published: 2022-06-02T17:27:46 Last Updated: 2024-08-04T01:37:16.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mlogclub/bbs-go/issues/112 - https://github.com/mlogclub/bbs-go/pull/113
CVE ID: CVE-2021-38239 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-20T13:43:49.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/issues/510
CVE ID: CVE-2021-38241 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-21T13:43:38.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.du1ge.com/archives/CVE-2021-38241
CVE ID: CVE-2021-38243 State: PUBLISHED Published: 2023-09-26T00:00:00.000Z Last Updated: 2025-06-18T14:19:19.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/P0wfuu/xunruicms-RCE
CVE ID: CVE-2021-38244 State: PUBLISHED Published: 2021-12-16T18:15:34 Last Updated: 2024-08-04T01:37:16.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cBioPortal/cbioportal/issues/8680 - https://github.com/cBioPortal/cbioportal/pull/8751
CVE ID: CVE-2021-38258 State: PUBLISHED Published: 2021-10-25T21:19:11 Last Updated: 2024-08-04T01:37:16.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback(). Additional Analyst Notes: - CVE Program Container: References: - https://mcusec.github.io/vulnerabilities_details#nxp_usb
CVE ID: CVE-2021-38260 State: PUBLISHED Published: 2021-10-25T21:19:14 Last Updated: 2024-08-04T01:37:16.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor(). Additional Analyst Notes: - CVE Program Container: References: - https://mcusec.github.io/vulnerabilities_details#nxp_usb
CVE ID: CVE-2021-38263 State: PUBLISHED Published: 2022-03-02T23:10:21 Last Updated: 2024-08-04T01:37:16.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-pag
learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-page - https://issues.liferay.com/browse/LPE-17061
CVE ID: CVE-2021-38264 State: PUBLISHED Published: 2022-03-02T23:06:32 Last Updated: 2024-08-04T01:37:16.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38264-reflected-xss-with-keywords-in-se
n/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38264-reflected-xss-with-keywords-in-search
CVE ID: CVE-2021-38265 State: PUBLISHED Published: 2022-03-02T23:03:31 Last Updated: 2024-08-04T01:37:16.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name
CVE ID: CVE-2021-38266 State: PUBLISHED Published: 2022-03-02T23:00:44 Last Updated: 2024-08-04T01:37:16.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-382
om - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38266 - https://issues.liferay.com/browse/LPE-17191
CVE ID: CVE-2021-38267 State: PUBLISHED Published: 2022-03-02T23:15:45 Last Updated: 2024-08-04T01:37:16.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL
References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry
CVE ID: CVE-2021-38268 State: PUBLISHED Published: 2022-03-02T18:45:26 Last Updated: 2024-08-04T01:37:16.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mx
erences: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP
CVE ID: CVE-2021-38269 State: PUBLISHED Published: 2022-03-02T23:25:56 Last Updated: 2024-08-04T01:37:16.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38269-stored-xss-with-gog
feray.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38269-stored-xss-with-gogo-shell-output
CVE ID: CVE-2021-38278 State: PUBLISHED Published: 2022-03-23T18:57:10 Last Updated: 2024-08-04T01:37:16.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function. Additional Analyst Notes: - CVE Program Container: References: - https://noob3xploiter.medium.com/hacking-the-tenda-ac10-1200-router-part-2-strcpy-buffer-overflow-92cd88e1d503
CVE ID: CVE-2021-38283 State: PUBLISHED Published: 2021-11-29T07:45:45 Last Updated: 2024-08-04T01:37:16.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information via a predictable /log URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.wipro.com/holmes/ - http://packetstormsecurity.com/files/165031/Wipro-Holmes-Orchestrator-20.4.1-File-Disclosure.html
CVE ID: CVE-2021-38289 State: PUBLISHED Published: 2022-07-12T12:33:15 Last Updated: 2024-08-04T01:37:16.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation - https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ
CVE ID: CVE-2021-38290 State: PUBLISHED Published: 2021-08-09T10:58:28 Last Updated: 2024-08-04T01:37:16.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/580 - https://github.com/daylightstudio/FUEL-CMS/commit/8a0d88ad6869623c90e24b3b2ea33352049d39a7
CVE ID: CVE-2021-38291 State: PUBLISHED Published: 2021-08-12T00:00:00 Last Updated: 2024-08-04T01:37:16.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Additional Analyst Notes: - CVE Program Container: References: - https://trac.ffmpeg.org/ticket/9312 - https://www.debian.org/security/2021/dsa-4990 - https://www.debian.org/security/2021/dsa-4998 - https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html - https://security.gentoo.org/glsa/202312-14
CVE ID: CVE-2021-38294 State: PUBLISHED Published: 2021-10-25T12:22:36 Last Updated: 2024-08-04T01:37:16.384Z Vendors: Apache Software Foundation Products: Apache Storm Problem Types: CWE-74 Description: A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E - https://seclists.org/oss-sec/2021/q4/
f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E - https://seclists.org/oss-sec/2021/q4/44 - http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html
CVE ID: CVE-2021-38295 State: PUBLISHED Published: 2021-10-14T19:55:12 Last Updated: 2024-08-04T01:37:16.335Z Vendors: Apache Software Foundation Products: Apache CouchDB, IBM Cloudant Problem Types: Privilege escalation Description: In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation v
min. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2 Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchdb.org/en/stable/cve/2021-38295.html
CVE ID: CVE-2021-38296 State: PUBLISHED Published: 2022-03-10T08:20:12 Last Updated: 2024-08-04T01:37:16.315Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: CWE-294 Description: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark
ffect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-38297 State: PUBLISHED Published: 2021-10-18T00:00:00 Last Updated: 2024-08-04T01:37:16.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/golang-announce - https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A - https://security.netapp.com/advisory/ntap-20211118-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQ
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/ - https://security.gentoo.org/glsa/202208-02 - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2021-38298 State: PUBLISHED Published: 2021-10-07T21:33:30 Last Updated: 2024-08-04T01:37:16.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/ad-manager/release-notes.html#7110
CVE ID: CVE-2021-38299 State: PUBLISHED Published: 2021-09-27T05:55:51 Last Updated: 2024-08-04T01:37:16.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/web-auth/webauthn-framework/releases - https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/
CVE ID: CVE-2021-38300 State: PUBLISHED Published: 2021-09-20T05:25:30 Last Updated: 2024-08-04T01:37:16.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/09/15/5 - https://security.netapp.com/advisory/ntap-20211008-0003/ - https://git.kernel.org/pub/scm/linux/kernel/git/
21/09/15/5 - https://security.netapp.com/advisory/ntap-20211008-0003/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10 - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-38302 State: PUBLISHED Published: 2021-08-13T16:48:50 Last Updated: 2024-08-04T01:37:16.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2021-014
CVE ID: CVE-2021-38303 State: PUBLISHED Published: 2021-09-28T18:52:48 Last Updated: 2024-08-04T01:37:16.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ederdemattos/Sureline_SUREedge_Migrator - https://github.com/ederdemattos/Sureline_SUREedge_Migrator/blob/main/4.png