Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32014 State: PUBLISHED Published: 2021-07-19T13:20:12 Last Updated: 2024-08-03T23:17:27.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js. Additional Analyst Notes: - CVE Program Container: References: - https://sheetjs.com/pro - https://www.oracle.com/security-alerts/cpujan2022.html - https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/ - https://www.npmjs.com/package/xlsx/v/0.17.0
CVE ID: CVE-2021-32015 State: PUBLISHED Published: 2021-06-08T16:58:20 Last Updated: 2024-08-03T23:17:27.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update. Additional Analyst Notes: - CVE Program Container: References: - https://www.nuvoton.com/support/product-related-information/security
alyst Notes: - CVE Program Container: References: - https://www.nuvoton.com/support/product-related-information/security-advisories/sa-001/
CVE ID: CVE-2021-32016 State: PUBLISHED Published: 2021-08-03T17:55:05.000Z Last Updated: 2025-05-30T16:01:49.521Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the writing of arbitrary files to a user-controlled location on the remote filesystem (with user-controlled content) via directory traversal, potentially leading to remote code and command execution. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2021-32016/ - https://cds.thalesgroup.com/en/tc
iner: References: - https://excellium-services.com/cert-xlm-advisory/cve-2021-32016/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-32016
CVE ID: CVE-2021-32017 State: PUBLISHED Published: 2021-08-03T16:01:31.000Z Last Updated: 2025-05-30T16:01:38.366Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the listing of the content of the remote file system. This can be used to identify the complete server filesystem structure, i.e., identifying all the directories and files. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2021-32017/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-32017
CVE ID: CVE-2021-32018 State: PUBLISHED Published: 2021-08-03T17:57:00.000Z Last Updated: 2025-05-30T16:01:52.327Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem, aka directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2021-32018/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-32018
CVE ID: CVE-2021-32019 State: PUBLISHED Published: 2021-08-02T20:35:47 Last Updated: 2024-08-03T23:17:27.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP. Additional Analyst Notes: - CVE Program Container: References: - https://openwrt.org/advisory/2021-08-01-1
CVE ID: CVE-2021-32020 State: PUBLISHED Published: 2021-05-03T21:12:44 Last Updated: 2024-08-03T23:17:28.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRTOS/FreeRTOS-Kernel/commit/c7a9a01c94987082b223d3e59969ede64363da63
CVE ID: CVE-2021-32021 State: PUBLISHED Published: 2021-11-10T17:33:00 Last Updated: 2024-08-03T23:17:27.949Z Vendors: n/a Products: BlackBerry Protect for Windows Problem Types: Denial of service Description: A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000088685
CVE ID: CVE-2021-32022 State: PUBLISHED Published: 2021-11-10T17:34:32 Last Updated: 2024-08-03T23:17:27.946Z Vendors: n/a Products: BlackBerry Protect for Windows Problem Types: Low privileged delete using CEF RPC server Description: A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system and gaining the ability to delete data from the local system. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000088685
CVE ID: CVE-2021-32023 State: PUBLISHED Published: 2021-11-10T17:35:32 Last Updated: 2024-08-03T23:17:29.496Z Vendors: n/a Products: BlackBerry Protect for Windows Problem Types: Elevation of privilege in message broker Description: An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentially execute code in the context of a BlackBerry Cylance service that has admin rights on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000088685
CVE ID: CVE-2021-32024 State: PUBLISHED Published: 2021-12-13T18:06:24 Last Updated: 2025-09-09T15:07:31.697Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP) Problem Types: CWE-1287 Description: A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in the context of the affected process. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000089042
CVE ID: CVE-2021-32025 State: PUBLISHED Published: 2022-03-09T20:37:56 Last Updated: 2025-08-22T15:36:00.384Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS) Problem Types: Elevation of privilege, CWE-368 Description: An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical
0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000090868
CVE ID: CVE-2021-32027 State: PUBLISHED Published: 2021-06-01T00:00:00 Last Updated: 2024-08-03T23:17:27.885Z Vendors: n/a Products: postgresql Problem Types: CWE-190 Description: A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1956876 - https://www.postgr
t Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1956876 - https://www.postgresql.org/support/security/CVE-2021-32027/ - https://security.netapp.com/advisory/ntap-20210713-0004/ - https://security.gentoo.org/glsa/202211-04
CVE ID: CVE-2021-32028 State: PUBLISHED Published: 2021-10-11T00:00:00 Last Updated: 2024-08-03T23:17:28.199Z Vendors: n/a Products: postgresql Problem Types: CWE-200 Description: A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1956877 - https://www.postgresql.org/support/security/CVE-2021-32028 - https://security.netapp.com/advisory/ntap-20211112-0003/ - https://security.gen
ql.org/support/security/CVE-2021-32028 - https://security.netapp.com/advisory/ntap-20211112-0003/ - https://security.gentoo.org/glsa/202211-04
CVE ID: CVE-2021-32029 State: PUBLISHED Published: 2021-10-08T16:44:22 Last Updated: 2024-08-03T23:17:29.448Z Vendors: n/a Products: postgresql Problem Types: CWE-200 Description: A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1956883 - https://www.postgresql.org/support/security/CVE-2021-32029/ - https://security.netapp.com/advisory/ntap-20211112-0003/
CVE ID: CVE-2021-32030 State: PUBLISHED Published: 2021-05-06T14:54:31.000Z Last Updated: 2025-10-21T23:25:47.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-o
ice's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md - https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass - https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/
CVE ID: CVE-2021-32032 State: PUBLISHED Published: 2021-05-21T03:10:43 Last Updated: 2024-08-03T23:17:28.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abort() operation in the associated cryptographic library from freeing internal resources, causing a memory leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustedfirmware.org - https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/crypto_multi_part_ops_abort_fail.rst - https://git.trustedfirmwa
d-firmware-m.git/tree/docs/security/security_advisories/crypto_multi_part_ops_abort_fail.rst - https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/commit/?id=7e2e523a1c4e9ac7b9cc4fd551831f7639ed5ff9
CVE ID: CVE-2021-32033 State: PUBLISHED Published: 2021-06-16T11:35:59 Last Updated: 2024-08-03T23:17:29.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, an attacker with short-time physical access to a device can set the internal real-time clock (RTC) to the future, generate one-time passwords, and reset the clock to the current time. This allows the generation of valid future time-bas
enerate one-time passwords, and reset the clock to the current time. This allows the generation of valid future time-based one-time passwords without having further access to the hardware token. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-007.txt - http://seclists.org/fulldisclosure/2021/Jun/39 - http://packetstormsecurity.com/files/163223/Protectimus-SLIM-NFC-Time-Manipulation.html
CVE ID: CVE-2021-32036 State: PUBLISHED Published: 2022-02-04T22:33:08.292976Z Last Updated: 2024-11-19T19:12:46.061Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-770 Description: An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.
ects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-59294
CVE ID: CVE-2021-32037 State: PUBLISHED Published: 2021-11-24T10:40:10.557726Z Last Updated: 2024-09-16T22:26:43.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-617 Description: An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2. Additional Analy
auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-59071
CVE ID: CVE-2021-32039 State: PUBLISHED Published: 2022-01-20T14:50:10.319200Z Last Updated: 2024-09-17T01:51:09.452Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc. Products: MongoDB for VS Code Problem Types: CWE-522 Description: Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
nd prior to version 0.7.0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 - https://jira.mongodb.org/browse/VSCODE-313
CVE ID: CVE-2021-32040 State: PUBLISHED Published: 2022-04-12T14:15:16.692284Z Last Updated: 2024-09-16T20:03:21.667Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-121 Description: It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prio
This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-58203 - https://jira.mongodb.org/browse/SERVER-59299 - https://jira.mongodb.org/browse/SERVER-60218 - https://security.netapp.com/advisory/ntap-20220609-0005/
CVE ID: CVE-2021-32050 State: PUBLISHED Published: 2023-08-29T15:24:30.389Z Last Updated: 2025-11-03T19:25:48.021Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB C Driver, MongoDB C++ Driver, MongoDB PHP Driver, MongoDB Swift Driver, MongoDB Node.js Driver Problem Types: CWE-200 Description: Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive informati
cation-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0). Additional Anal
s of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/PHPC-1869 - https://jira.mongodb.org/browse/CXX-2028 - https://jira.mongodb.org/browse/SWIFT-1229 - https://jira.mongodb.org/browse/CDRIVER-3797 - https://jira.mongodb.org/browse/NODE-3356 - https://security.netapp.com/advisory/ntap-20231006-0001/
CVE ID: CVE-2021-32051 State: PUBLISHED Published: 2021-05-14T00:38:38 Last Updated: 2024-08-03T23:17:28.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.hexagonsafetyinfrastructure.com/products/utilities-and-communications-products/advanced-utility-gis/hexagon-ginius - http://packetstormsecurity.com/files/162534/Hexagon-G-nius-Auskunftsportal-SQL-Injection.html - https://gist.githubusercontent.com/mke1985/a21a71098f48829916dfec74eff1e24a/raw/f635b060ad03e23fd887de48a79b70040
html - https://gist.githubusercontent.com/mke1985/a21a71098f48829916dfec74eff1e24a/raw/f635b060ad03e23fd887de48a79b70040daadadb/CVE-2021-32051
CVE ID: CVE-2021-32052 State: PUBLISHED Published: 2021-05-06T15:49:20 Last Updated: 2024-08-03T23:17:28.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/3.2/releases
References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/3.2/releases/security/ - http://www.openwall.com/lists/oss-security/2021/05/06/1 - https://www.djangoproject.com/weblog/2021/may/06/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/ - https://security.netapp.com/advisory/ntap-20210611-0002/
CVE ID: CVE-2021-32053 State: PUBLISHED Published: 2021-05-10T20:43:45 Last Updated: 2024-08-03T23:17:28.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests. Additional Analyst Notes: - CVE Program Container: References: - https://hapifhir.io - https://github.com/hapifhir/hapi-fhir/issues/2641 - https://github.com/hapifhir/hapi-fhir/pull/2642
CVE ID: CVE-2021-32054 State: PUBLISHED Published: 2021-05-14T20:39:25 Last Updated: 2024-08-03T23:17:28.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FirelyTeam/spark/releases/tag/v1.5.5-r4 - https://github.com/FirelyTeam/spark/compare/v1.5.4-r4...v1.5.5-r4 - https://github.com/FirelyTeam/spark/commit/9c79320059f92d8aa4fbd6cc4fa8f9d5d6ba9941
CVE ID: CVE-2021-32055 State: PUBLISHED Published: 2021-05-05T15:06:52 Last Updated: 2024-08-03T23:17:29.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/muttmua/mutt/-/commit/7c4779ac24d2fb68a2a47b58c7904118f40965d5 - http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20210503/000036.html - https://github