Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37593 State: PUBLISHED Published: 2021-07-27T23:12:15 Last Updated: 2024-08-04T01:23:01.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/advisto/peel-shopping/issues/3 - http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping
eel-shopping/issues/3 - http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping/ - https://github.com/faisalfs10x/CVE-IDs/blob/main/2021/CVE-2021-37593/Proof_of_Concept.md
CVE ID: CVE-2021-37594 State: PUBLISHED Published: 2021-07-27T23:33:29 Last Updated: 2024-08-04T01:23:01.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9 - https://github.com/FreeRDP/FreeRDP/compare/2.3.2...2.4.0
CVE ID: CVE-2021-37595 State: PUBLISHED Published: 2021-07-27T23:33:12 Last Updated: 2024-08-04T01:23:01.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE File Contents Request PDU. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9 - https://github.com/FreeRDP/FreeRDP/compare/2.3.2...2.4.0
CVE ID: CVE-2021-37596 State: PUBLISHED Published: 2021-07-27T23:45:39 Last Updated: 2024-08-04T01:23:01.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram Web K Alpha 0.6.1 allows XSS via a document name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/morethanwords/tweb/commit/11d2fe01363889f20c8baa2217ed4aad445c5551
CVE ID: CVE-2021-37597 State: PUBLISHED Published: 2021-08-19T18:51:04 Last Updated: 2024-08-04T01:23:01.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0023/FEYE-2021-0023.md
CVE ID: CVE-2021-37598 State: PUBLISHED Published: 2021-08-19T18:48:02 Last Updated: 2024-08-04T01:23:01.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0024/FEYE-2021-0024.md
CVE ID: CVE-2021-37599 State: PUBLISHED Published: 2021-08-12T20:40:53 Last Updated: 2024-08-04T01:23:01.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remote, unauthenticated attacker to read the database (and execute code in some situations) via the txtPassword parameter. Additional Analyst Notes: - CVE Program Container: References: - https://slazarus.xyz/winscribe.html - https://www.nuance.com/dragon/business-solutions/winscribe-dictation-workflow.html
CVE ID: CVE-2021-37600 State: PUBLISHED Published: 2021-07-28T00:00:00 Last Updated: 2024-08-04T01:23:01.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/karelzak/util-linux/issues/1395 - https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c - https://securi
ux/issues/1395 - https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c - https://security.netapp.com/advisory/ntap-20210902-0002/ - https://security.gentoo.org/glsa/202401-08 - https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
CVE ID: CVE-2021-37601 State: PUBLISHED Published: 2021-07-28T13:52:17 Last Updated: 2024-08-04T01:23:01.400Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations. Additional Analyst Notes: - CVE Program Container: References: - https://prosody.im/security/advisory_20210722/ - https://prosody.im/ - http://www.openwall.com/lists/oss-security/2021/07/28/4 - https://lists.fedoraproject.org/archives/list/package
dy.im/ - http://www.openwall.com/lists/oss-security/2021/07/28/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4AGH4IR7O2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBBKDIHO27DY/
CVE ID: CVE-2021-37604 State: PUBLISHED Published: 2021-08-05T15:43:37 Last Updated: 2024-08-04T01:23:01.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated prior to the message authentication. With this vulnerability in place, an attacker may increment the incoming frame counter values by injecting messages with a sufficiently large frame counter value and invalid payload. This results in denial of service/valid packets in the network. There is also a possibility of a replay attack in the stack. Additional Analyst Notes:
ce/valid packets in the network. There is also a possibility of a replay attack in the stack. Additional Analyst Notes: - CVE Program Container: References: - https://www.microchip.com/product-change-notifications/#/ - https://www.microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol - https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf - https://www.microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads - https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability
CVE ID: CVE-2021-37605 State: PUBLISHED Published: 2021-08-05T15:52:38 Last Updated: 2024-08-04T01:23:01.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check (MIC) bytes. Additional Analyst Notes: - CVE Program Container: References: - https://www.microchip.com/product-change-notifications/#/ - https://www.microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol - https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf - https://www.microchip.com/en-us/development-tools-tool
/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf - https://www.microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads - https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.51.0.101-readme.pdf - https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability
CVE ID: CVE-2021-37606 State: PUBLISHED Published: 2021-07-28T18:34:57 Last Updated: 2024-08-04T01:23:01.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision in the bottom bits of the hashes of two messages, as demonstrated by an attack against a long-running web service that allows the attacker to infer collisions by measuring timing differences. Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=27978878 - https://peter.website/meow-hash-cryptanalysis
CVE ID: CVE-2021-37608 State: PUBLISHED Published: 2021-08-18T07:50:12 Last Updated: 2024-08-04T01:23:01.228Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297. Additional Analyst Notes: - CVE Program Container: References: - https://ofbiz.apache.org/security.html - https://lists.apache.org/thread.html/r8d824c1491f552da820ef181b7b2d0541410b3a8748b7906265bbb03%
ache.org/security.html - https://lists.apache.org/thread.html/r8d824c1491f552da820ef181b7b2d0541410b3a8748b7906265bbb03%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rca5b167748f0d04816747d68c4ceb7afff9b7b7556211793847d3382%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/re438aa1054c22eb65f2a047c337259e3b421a30b4ef11afb28c36b93%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rae6c5ec2c5fc00cbc75612ab6d94a8cc0d02603228cab6316f2b858e%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r23d04e9c477c3547f6cc87f11626899617927053bbac15b72645ac7b%40%3Ccommits.ofbiz.apache.org%3E - https:/
che.org/thread.html/r23d04e9c477c3547f6cc87f11626899617927053bbac15b72645ac7b%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r5899ec8324d961863e162b75679309ba4ebe9dbd79cd28edbaafcdca%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r164c91c47d638869c38e41b3ce501ecaa71f385939f098b2e04df049%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r21f76ccb0fca2e2b236328d91b9d4b760352fae6293d5275f1c25a3a%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rdfab8e1df42888416e2705acc86b32e1ea0a03a131ed3ea4ff38f4af%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rc40120f33e3
b32e1ea0a03a131ed3ea4ff38f4af%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rc40120f33e38f51fc1036c6572094d44cb19d73aa8d40142165ed92d%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rb4024165b7ef0428761aa0c334d44bf8bd05b533310589ee30e3b6e1%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/radf6d421ec20c9e6d738155d380514f9ba1c9386c5500bda2c9429aa%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rfd639ca63c8a80534b65623d9c6068859d17e2dfaaeb00a24e9fec9c%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r5b7e87f970d678f819263b35b7179f0d979f5c0f716d789aec6536f9%40
.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r5b7e87f970d678f819263b35b7179f0d979f5c0f716d789aec6536f9%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/ra582196fe06566ac4dbd896223f58c379cdb38088df95def41517422%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rd7d60e3276b8a9a106a6b057d3976fe123beff6c47c17ba5b3090140%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r3f1046dccb61568ca8d871f4527f274b2a531e0865fbe2c9afbfecce%40%3Cnotifications.ofbiz.apache.org%3E
CVE ID: CVE-2021-37613 State: PUBLISHED Published: 2022-02-10T16:19:24 Last Updated: 2024-08-04T01:23:01.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu - https://advisories.stormshield.eu/2021-050/
CVE ID: CVE-2021-37614 State: PUBLISHED Published: 2021-08-05T19:33:06 Last Updated: 2024-08-04T01:23:01.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fi
nts that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), and 2021.0.3 (13.0.3). Additional Analyst Notes: - CVE Program Container: References: - https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021 - https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm - https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8 - https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htm
CVE ID: CVE-2021-37615 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T01:23:01.281Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-476 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a craf
tially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/pull/1758 - https://github.com/Exiv2/exiv2/security/advisories/GHSA-h9x9-4f77-336w - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33B
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-37616 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T01:23:01.227Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-476 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a craf
tially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-54f7-vvj7-545w - https://github.com/Exiv2/exiv2/pull/1758 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fe
rg/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-37617 State: PUBLISHED Published: 2021-08-18T17:25:10 Last Updated: 2024-08-04T01:23:01.309Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-426 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malic
file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\` system folder and verify that there is no malicious `C:\Uninstall.exe` file on the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v - https://github.com/nextcloud/desktop/pull/3497 - https://hackerone.com
isories/security/advisories/GHSA-6q2w-v879-q24v - https://github.com/nextcloud/desktop/pull/3497 - https://hackerone.com/reports/1240749
CVE ID: CVE-2021-37618 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T01:23:01.291Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-125 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image f
oit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-583f-w9pm-99r2 - https://github.com/Exiv2/exiv2/pull/1759 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/pac
%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-37619 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T01:23:01.284Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-125 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a
t the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v - https://github.com/Exiv2/exiv2/pull/1752 - https://lists.fedoraproject.org/archives/list/package-announce%40lis
c-6m8v - https://github.com/Exiv2/exiv2/pull/1752 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-37620 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T01:23:01.285Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-125 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image fi
it the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-v5g7-46xf-h728 - https://github.com/Exiv2/exiv2/pull/1769 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html - https://security.gentoo
FJWKUU7SO3QATCIXCZJERGAC/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html - https://security.gentoo.org/glsa/202312-06