Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nning in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-362.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://security.netapp.com/advisory/ntap-20210326-0001/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - https://git.kernel
m/advisory/ntap-20210326-0001/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7c77474b2d22176d2bfb592ec74e0f2cb71352c9 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5a264285ed1cd32e26d9de4f3c8c6855e467fd63 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3194a1746e8aabe86075fd3c5e7cf1f4632d7f16
CVE ID: CVE-2021-26932 State: PUBLISHED Published: 2021-02-17T00:00:00 Last Updated: 2024-08-03T20:33:41.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying t
tely, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-361.html - https://lists.fedoraproject.org/archi
VE Program Container: References: - http://xenbits.xen.org/xsa/advisory-361.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://security.netapp.com/advisory/ntap-20210326-0001/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ebee0eab08594b2bd5db716288a4f1ae5936e9bc
CVE ID: CVE-2021-26933 State: PUBLISHED Published: 2021-02-17T01:05:46 Last Updated: 2024-08-03T20:33:41.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory. Additional Analyst Notes: - CVE Program Container: References:
s no guarantee when all the writes will reach the memory. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-364.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/ - https://www.debian.org/security/2021/dsa-4888
CVE ID: CVE-2021-26934 State: PUBLISHED Published: 2021-02-17T01:07:59 Last Updated: 2024-08-03T20:33:41.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-363.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/ - https://lists.fedorap
chives/list/package-announce%40lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/ - https://security.netapp.com/advisory/ntap-20210326-0001/
CVE ID: CVE-2021-26935 State: PUBLISHED Published: 2021-03-18T14:06:55 Last Updated: 2024-08-03T20:33:41.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the event_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49657 - https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-26935
CVE ID: CVE-2021-26936 State: PUBLISHED Published: 2021-02-10T17:53:59 Last Updated: 2024-08-03T20:33:41.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: The replay-sorcery program in ReplaySorcery 0.4.0 through 0.5.0, when using the default setuid-root configuration, allows a local attacker to escalate privileges to root by specifying video output paths in privileged locations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matanui159/ReplaySorcery/releases - http://www.openwall.com/lists/oss-security/2021/02/10/1
CVE ID: CVE-2021-26937 State: PUBLISHED Published: 2021-02-09T19:35:50.000Z Last Updated: 2025-05-09T20:03:29.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html - https://www.openwall.com/lists/oss-security/2021/02/09/3 - https://ftp.gnu.org/gnu/screen/ - http://www.openwall.com/lists/oss-security/2021/02/09/8 - https://lists.debia
2/09/3 - https://ftp.gnu.org/gnu/screen/ - http://www.openwall.com/lists/oss-security/2021/02/09/8 - https://lists.debian.org/debian-lts-announce/2021/02/msg00031.html - https://www.debian.org/security/2021/dsa-4861 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJWLXP45POUUYBJRRWPVAWNZDJTLYWVM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNWBOIDEPOEQS5RMQVMFKHKXJCGNYWBL/ - https://security.gentoo.org/glsa/202105-11
CVE ID: CVE-2021-26938 State: PUBLISHED Published: 2021-02-10T17:54:46 Last Updated: 2024-08-03T20:33:41.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xrayan/CVE-/discussions/2
CVE ID: CVE-2021-26939 State: PUBLISHED Published: 2021-02-10T17:55:31 Last Updated: 2024-08-03T20:33:41.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NOTE: third parties report that this is a site-specific problem Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xrayan/CVE-/discussions/4 - https://bugzilla.opensuse.org/show_bug.cgi?id=1182095
CVE ID: CVE-2021-26940 State: REJECTED Published: 2021-06-02T12:12:43 Last Updated: 2021-06-02T12:12:43 Description: No description available.
CVE ID: CVE-2021-26943 State: PUBLISHED Published: 2021-03-31T19:26:31 Last Updated: 2024-08-03T20:33:41.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM (issue 3 of 3). Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/support/FAQ/1045541/ - https://www.youtube.com/watch?v=1H3AfaVyeuk
CVE ID: CVE-2021-26945 State: PUBLISHED Published: 2021-06-08T11:39:06 Last Updated: 2024-08-03T20:33:41.491Z Vendors: n/a Products: OpenEXR Problem Types: CWE-400 Description: An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947591
CVE ID: CVE-2021-26946 State: REJECTED Published: N/A Last Updated: 2023-05-16T00:00:00 Description: No description available.
CVE ID: CVE-2021-26947 State: PUBLISHED Published: 2023-04-25T18:33:41.553Z Last Updated: 2024-08-03T20:33:41.300Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/107694 - https://www.debian.org/security/2023/dsa-5399
CVE ID: CVE-2021-26948 State: PUBLISHED Published: 2022-03-03T00:00:00 Last Updated: 2024-08-03T20:33:41.561Z Vendors: n/a Products: htmldoc Problem Types: CWE-479 Description: Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/htmldoc/issues/410
CVE ID: CVE-2021-26950 State: PUBLISHED Published: 2022-08-18T19:44:19.000Z Last Updated: 2025-05-05T16:53:21.879Z Vendors: n/a Products: Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products Problem Types: denial of service Description: Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00628.html
CVE ID: CVE-2021-26951 State: PUBLISHED Published: 2021-02-09T22:07:49 Last Updated: 2024-08-03T20:33:41.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0015.html
CVE ID: CVE-2021-26952 State: PUBLISHED Published: 2021-02-09T22:07:42 Last Updated: 2024-08-03T20:33:41.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0016.html
CVE ID: CVE-2021-26953 State: PUBLISHED Published: 2021-02-09T22:06:38 Last Updated: 2024-08-03T20:33:41.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0017.html
CVE ID: CVE-2021-26954 State: PUBLISHED Published: 2021-02-09T22:07:33 Last Updated: 2024-08-03T20:33:41.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0018.html
CVE ID: CVE-2021-26955 State: PUBLISHED Published: 2021-02-09T22:07:26 Last Updated: 2024-08-03T20:33:41.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0019.html
CVE ID: CVE-2021-26956 State: PUBLISHED Published: 2021-02-09T22:06:48 Last Updated: 2024-08-03T20:33:41.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0019.html
CVE ID: CVE-2021-26957 State: PUBLISHED Published: 2021-02-09T22:07:18 Last Updated: 2024-08-03T20:33:41.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0019.html
CVE ID: CVE-2021-26958 State: PUBLISHED Published: 2021-02-09T22:07:10 Last Updated: 2024-08-03T20:33:41.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0019.html
CVE ID: CVE-2021-26959 State: REJECTED Published: 2021-02-09T22:06:57 Last Updated: 2021-02-12T15:25:27 Description: No description available.
CVE ID: CVE-2021-26960 State: PUBLISHED Published: 2021-03-05T15:57:56 Last Updated: 2024-08-03T20:33:41.313Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote unauthenticated cross-site request forgery (csrf) Description: A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrar
ful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt
CVE ID: CVE-2021-26961 State: PUBLISHED Published: 2021-03-05T15:50:56 Last Updated: 2024-08-03T20:33:41.562Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote unauthenticated cross-site request forgery (csrf) Description: A remote unauthenticated cross-site request forgery (csrf) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an unauthenticated remote attacker to conduct a CSRF attack against a vulnerable system. A successful exploit would consist of an attacker persuading an authorized user to follow a malicious link, resulting in arbitrar
CVE ID: CVE-2021-26962 State: PUBLISHED Published: 2021-03-05T15:56:03 Last Updated: 2024-08-03T20:33:41.382Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authenticated arbitrary command execution Description: A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise. Additional Analyst Notes: - CVE
y commands as root on the underlying operating system leading to full system compromise. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt
CVE ID: CVE-2021-26963 State: PUBLISHED Published: 2021-03-05T16:08:40 Last Updated: 2024-08-03T20:33:41.564Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authenticated arbitrary command execution Description: A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Vulnerabilities in the AirWave CLI could allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to full system compromise. Additional Analyst Notes: - CVE
CVE ID: CVE-2021-26964 State: PUBLISHED Published: 2021-03-05T16:06:09 Last Updated: 2024-08-03T20:33:41.378Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authentication restriction bypass Description: A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the
onsist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt
CVE ID: CVE-2021-26965 State: PUBLISHED Published: 2021-03-05T16:29:58 Last Updated: 2024-08-03T20:33:41.414Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authenticated sql injection Description: A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database. Additional Analyst Notes: - CVE Program Container: References:
modify sensitive information in the underlying database. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt
CVE ID: CVE-2021-26966 State: PUBLISHED Published: 2021-03-05T16:10:31 Last Updated: 2024-08-03T20:33:41.406Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authenticated sql injection Description: A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database. Additional Analyst Notes: - CVE Program Container: References:
CVE ID: CVE-2021-26967 State: PUBLISHED Published: 2021-03-05T16:33:05 Last Updated: 2024-08-03T20:40:46.952Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote reflected cross-site scripting (xss) Description: A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the cont
terface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the AirWave management interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt
CVE ID: CVE-2021-26968 State: PUBLISHED Published: 2021-03-05T16:35:26 Last Updated: 2024-08-03T20:40:45.794Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: remote authenticated stored cross-site scripting (xss) Description: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser
er of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt