Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3500 State: PUBLISHED Published: 2021-06-24T18:02:00 Last Updated: 2024-08-03T16:53:17.850Z Vendors: n/a Products: djvulibre Problem Types: CWE-787 Description: A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file may lead to application crash and other consequences. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1943685 - https://www.debian.org/security/2021/dsa-5032
CVE ID: CVE-2021-3501 State: PUBLISHED Published: 2021-05-05T22:31:28 Last Updated: 2024-08-03T16:53:17.850Z Vendors: n/a Products: kernel Problem Types: CWE-787 Description: A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1950136 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3
at.com/show_bug.cgi?id=1950136 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a - https://security.netapp.com/advisory/ntap-20210618-0008/
CVE ID: CVE-2021-3502 State: PUBLISHED Published: 2021-05-07T11:46:21 Last Updated: 2024-08-03T16:53:17.966Z Vendors: n/a Products: avahi Problem Types: CWE-617 Description: A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1946914 - https://github.com/lathiat/avahi/issues/338
CVE ID: CVE-2021-3503 State: PUBLISHED Published: 2022-04-18T16:20:37 Last Updated: 2024-08-03T16:53:17.916Z Vendors: n/a Products: wildfly Problem Types: CWE-200 Description: A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1942693 - https://issues.redhat.com/browse/WFLY-11933 - https://github.com/wildfly/wildfly/pull/14136 - https://github.com/advisories/GHSA-c4r5-xvgw-2942 - https://access.redhat.com/security/cve/CVE-2021-3503
CVE ID: CVE-2021-3504 State: PUBLISHED Published: 2021-05-11T22:30:25 Last Updated: 2024-08-03T16:53:17.616Z Vendors: n/a Products: hivex Problem Types: CWE-125 Description: A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1949687 - https://lists.debian.org/debi
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1949687 - https://lists.debian.org/debian-lts-announce/2021/05/msg00011.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22/
CVE ID: CVE-2021-3505 State: PUBLISHED Published: 2021-04-19T20:22:05 Last Updated: 2024-08-03T16:53:17.854Z Vendors: n/a Products: libtpms Problem Types: CWE-331 Description: A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1950046 - https://github.com/stefanberger/libtpms/issues/183 -
References: - https://bugzilla.redhat.com/show_bug.cgi?id=1950046 - https://github.com/stefanberger/libtpms/issues/183 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/
CVE ID: CVE-2021-3506 State: PUBLISHED Published: 2021-04-19T21:11:52 Last Updated: 2024-08-03T16:53:17.710Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1944298 - https://www.openwall.com/lists/oss-securit
ontainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1944298 - https://www.openwall.com/lists/oss-security/2021/03/28/2 - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg2520013.html - http://www.openwall.com/lists/oss-security/2021/05/08/1 - https://security.netapp.com/advisory/ntap-20210611-0007/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
CVE ID: CVE-2021-3507 State: PUBLISHED Published: 2021-05-06T15:16:14 Last Updated: 2024-08-03T16:53:17.925Z Vendors: n/a Products: QEMU Problem Types: CWE-119 Description: A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1951118 - http
itional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1951118 - https://security.netapp.com/advisory/ntap-20210528-0005/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2021-3508 State: PUBLISHED Published: 2021-04-28T13:44:09 Last Updated: 2024-08-03T16:53:17.647Z Vendors: n/a Products: PDFResurrect Problem Types: CWE-835 Description: A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1951198 - https://github.com/enferex/pdfresurrect/issues/17
CVE ID: CVE-2021-3509 State: PUBLISHED Published: 2021-05-26T23:56:39 Last Updated: 2024-08-03T16:53:17.842Z Vendors: n/a Products: ceph-dashboard Problem Types: CWE-79 Description: A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1950116 - https://github.com
t Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1950116 - https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409 - https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10ca - https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b - https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27
CVE ID: CVE-2021-3510 State: PUBLISHED Published: 2021-10-05T20:50:17.320779Z Last Updated: 2024-09-16T19:04:43.233Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-588 Description: Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4 Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4
CVE ID: CVE-2021-3511 State: PUBLISHED Published: 2021-04-28T00:45:26 Last Updated: 2024-08-03T16:53:17.809Z Vendors: BUFFALO INC. Products: Buffalo broadband routers Problem Types: Information Disclosure Description: Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmw
e Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware V
r.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to obtain information such as configuration via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.buffalo.jp/news/detail/20210427-01.html - https://jvn.jp/en/vu/JVNVU99235714/index.html
CVE ID: CVE-2021-3512 State: PUBLISHED Published: 2021-04-28T00:45:27 Last Updated: 2024-08-03T16:53:17.975Z Vendors: BUFFALO INC. Products: Buffalo broadband routers Problem Types: Improper Access Control Description: Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-U
mware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote un
e Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to bypass access restriction and to start telnet service and execute arbitrary OS commands with root privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.buffalo.jp/news/detail/20210427-01.html - https://jvn.jp/en/vu/JVNVU99235714/index.html
CVE ID: CVE-2021-3513 State: PUBLISHED Published: 2022-08-22T14:45:08 Last Updated: 2024-08-03T16:53:17.970Z Vendors: n/a Products: keycloak Problem Types: CWE-522 Description: A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1953439 - https://access.redhat.com/security/cve/CVE-2021-3513
CVE ID: CVE-2021-3514 State: PUBLISHED Published: 2021-05-28T00:00:00 Last Updated: 2024-08-03T16:53:17.927Z Vendors: n/a Products: 389-ds-base Problem Types: CWE-476 Description: When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/389ds/389-ds-base/issues/4711 - https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
CVE ID: CVE-2021-3515 State: PUBLISHED Published: 2021-06-01T13:31:40 Last Updated: 2024-08-03T16:53:17.757Z Vendors: n/a Products: pglogical Problem Types: CWE-77 Description: A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription(). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1954112
CVE ID: CVE-2021-3516 State: PUBLISHED Published: 2021-06-01T13:38:13 Last Updated: 2024-08-03T16:53:17.809Z Vendors: n/a Products: libxml2 Problem Types: CWE-416 Description: There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html - h
t.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html - https://bugzilla.redhat.com/show_bug.cgi?id=1954225 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ - https://security.gentoo.org/glsa/202107-05 - https://www.oracle.com/security-alerts/cpujan2022.html - https://gitlab.gnome.org/GNOME/libxml2/-/issues/230 - https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539 - https://security.netapp.com/advisory/ntap-20210716-0005/
CVE ID: CVE-2021-3517 State: PUBLISHED Published: 2021-05-19T13:45:00 Last Updated: 2024-08-03T16:53:17.731Z Vendors: n/a Products: libxml2 Problem Types: CWE-787 Description: There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. Additional Analyst Notes: - CVE Program Contai
ker is able to use memory information to further exploit the application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html - https://bugzilla.redhat.com/show_bug.cgi?id=1954232 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r
15b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://security.gentoo.org/glsa/202107-05 - https://security.netapp.com/advisory/ntap-20210625-0002/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211022-0004/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-3518 State: PUBLISHED Published: 2021-05-18T11:20:24 Last Updated: 2024-08-03T17:01:07.460Z Vendors: n/a Products: libxml2 Problem Types: CWE-416 Description: There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ - https://lists.debian.org/debian-lts-announce/2021/0
0lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html - https://bugzilla.redhat.com/show_bug.cgi?id=1954242 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://security.gentoo.org/glsa/202107-05 - https://security.netapp.com/advisory/ntap-20210625-0002/ - htt
che.org%3E - https://security.gentoo.org/glsa/202107-05 - https://security.netapp.com/advisory/ntap-20210625-0002/ - http://seclists.org/fulldisclosure/2021/Jul/58 - http://seclists.org/fulldisclosure/2021/Jul/54 - http://seclists.org/fulldisclosure/2021/Jul/55 - http://seclists.org/fulldisclosure/2021/Jul/59 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://support.apple.com/kb/HT212605 - https://support.apple.com/kb/HT212602 - https://support.apple.com/kb/HT212601 - https://support.apple.com/kb/HT212604 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-3519 State: PUBLISHED Published: 2021-11-12T22:05:29 Last Updated: 2024-08-03T17:01:07.319Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Lenovo Products: Desktop BIOS Problem Types: CWE-287 Description: A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-67440
CVE ID: CVE-2021-3520 State: PUBLISHED Published: 2021-06-02T12:32:32 Last Updated: 2024-08-03T17:01:07.870Z Vendors: n/a Products: lz4 Problem Types: CWE-190 Description: There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1954559 - https://www.oracle.com//security-alerts
m Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1954559 - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0005/
CVE ID: CVE-2021-3521 State: PUBLISHED Published: 2022-08-22T00:00:00 Last Updated: 2024-08-03T17:01:07.975Z Vendors: n/a Products: RPM Problem Types: CWE-347 Description: There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator
data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1941098 - https://access.redhat.com/security/cve/CVE-2021-3521 - https://github.com/rpm-software-management/rpm/pull/1795/ - https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 - https://security.gentoo.org/glsa/202210-22
CVE ID: CVE-2021-3522 State: PUBLISHED Published: 2021-06-02T14:38:16 Last Updated: 2024-08-03T17:01:08.139Z Vendors: n/a Products: GStreamer Problem Types: CWE-125 Description: GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1954761 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20211022-0004/ - https://security.gentoo.org/glsa/202208-31
CVE ID: CVE-2021-3523 State: PUBLISHED Published: 2022-04-27T20:58:08 Last Updated: 2024-08-03T17:01:07.705Z Vendors: n/a Products: apicast Problem Types: CWE-281 Description: A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1954805