Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22526 State: PUBLISHED Published: 2021-09-13T12:00:50.890830Z Last Updated: 2024-09-16T18:43:47.781Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Micro Focus Products: NetIQ Access Manager Problem Types: CWE-601 Description: Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 Additional Analyst Notes: - CVE Program Container: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager501-release-notes/accessmanager501-release-notes.html - https://support.microfocus.com/kb/doc.php?id=7025257
CVE ID: CVE-2021-22527 State: PUBLISHED Published: 2021-09-13T11:56:22.591599Z Last Updated: 2024-09-16T23:30:39.657Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: Micro Focus Products: NetIQ Access Manager Problem Types: CWE-200 Description: Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 Additional Analyst Notes: - CVE Program Container: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager501-release-notes/accessmanager501-release-notes.html - https://support.microfocus.com/kb/doc.php?id=7025258
CVE ID: CVE-2021-22528 State: PUBLISHED Published: 2021-09-13T11:42:07.116392Z Last Updated: 2024-09-17T02:21:09.794Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Micro Focus Products: NetIQ Access Manager Problem Types: CWE-79 Description: Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7025259 - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager501-release-notes/accessmanager501-release-notes.html
CVE ID: CVE-2021-22529 State: PUBLISHED Published: 2024-08-28T06:29:33.325Z Last Updated: 2024-08-28T13:31:13.264Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: OpenText Products: NetIQ Advance Authentication Problem Types: CWE-200 Description: A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version before 6.3.5.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html
CVE ID: CVE-2021-22530 State: PUBLISHED Published: 2024-08-28T06:29:20.166Z Last Updated: 2024-08-28T13:31:54.122Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: OpenText Products: NetIQ Advance Authentication Problem Types: CWE-667 Description: A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/advan
efore 6.3.5.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html
CVE ID: CVE-2021-22531 State: PUBLISHED Published: 2022-05-12T18:52:38 Last Updated: 2024-08-03T18:44:14.026Z Vendors: n/a Products: NetIQ Access Manager Problem Types: Cross Site Scripting vulnerability Description: A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0 Additional Analyst Notes: - CVE Program Container: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html
CVE ID: CVE-2021-22532 State: PUBLISHED Published: 2024-09-12T12:44:20.724Z Last Updated: 2024-09-12T12:57:35.202Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: OpenText Products: eDirectory Problem Types: CWE-770 Description: Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/edirectory-92/edirectory925_releasenotes/data/edirectory925_releasenotes.html
CVE ID: CVE-2021-22533 State: PUBLISHED Published: 2024-09-12T12:43:51.734Z Last Updated: 2024-09-12T13:06:12.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: OpenText Products: eDirectory Problem Types: CWE-532 Description: Possible Insertion of Sensitive Information into Log File Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.4.0000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netiq.com/documentation/edirectory-92/edirectory925_releasenotes/data/edirectory925_releasenotes.html
CVE ID: CVE-2021-22535 State: PUBLISHED Published: 2021-09-28T13:54:45 Last Updated: 2024-08-03T18:44:14.070Z Vendors: n/a Products: Directory and Resource Administrator (DRA) Problem Types: unauthorized information security disclosure. Description: Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7025273
CVE ID: CVE-2021-22538 State: PUBLISHED Published: 2021-03-31T21:10:13 Last Updated: 2024-08-03T18:44:13.699Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Google LLC Products: Exposure Notifications Verification Server Problem Types: CWE-20 Description: A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event
es than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-5v95-v8c8-3rh6 - https://github.com/google/exposure-notifications-verification-server/commit/eb8cf40b12dbe79304f1133c06fb73419383cd95 - https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1 - https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0
CVE ID: CVE-2021-22539 State: PUBLISHED Published: 2021-04-16T10:15:12.912725Z Last Updated: 2024-09-17T01:46:31.592Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Google LLC Products: VSCode-Bazel Problem Types: CWE-73 Description: An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bazelbuild/
version 0.4.1 or above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcv - https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1
CVE ID: CVE-2021-22540 State: PUBLISHED Published: 2021-04-22T14:15:17 Last Updated: 2024-08-03T18:44:14.025Z Vendors: Google LLC Products: Dart SDK Problem Types: CWE-79 Description: Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522 - https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588
CVE ID: CVE-2021-22543 State: PUBLISHED Published: 2021-05-26T10:30:10.775212Z Last Updated: 2024-09-16T23:26:05.122Z Vendors: Linux Kernel Products: Linux Kernel Problem Types: CWE-119 Description: An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584 - http://www.
ntainer: References: - https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584 - http://www.openwall.com/lists/oss-security/2021/06/26/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI775S/ - https://security.netapp.com/advisory/ntap-20210708-0002/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE ID: CVE-2021-22545 State: PUBLISHED Published: 2021-06-29T11:55:11.520266Z Last Updated: 2024-09-16T16:18:11.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Google LLC Products: Bindiff Problem Types: CWE-416 Description: An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7 Additional Analyst Notes: - CVE Program Container: References: - https://www.zynamics.com/bindiff/manual/index.html#nyyyy7
CVE ID: CVE-2021-22547 State: PUBLISHED Published: 2021-05-04T13:05:17 Last Updated: 2024-08-03T18:44:13.675Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Google LLC Products: Google Cloud IoT Device SDK for Embedded C Problem Types: CWE-120 Description: In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater. Additional Analyst Notes: - CVE Progra
pgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/blob/master/RELEASE-NOTES.md - https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/pull/119
CVE ID: CVE-2021-22548 State: PUBLISHED Published: 2021-06-08T13:15:13.466433Z Last Updated: 2024-09-17T01:11:52.435Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Google LLC Products: Asylo Problem Types: CWE-788 Description: An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c Additional Analyst Notes: - CVE Program Container: Reference
oogle/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
CVE ID: CVE-2021-22549 State: PUBLISHED Published: 2021-06-08T13:15:14.120892Z Last Updated: 2024-09-17T02:42:42.905Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Google LLC Products: Asylo Problem Types: CWE-823 Description: An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/ecfcd0008b6f8f63c6fa3cc1b62fcd4a52f2c0ad
CVE ID: CVE-2021-22550 State: PUBLISHED Published: 2021-06-08T13:15:14.762702Z Last Updated: 2024-09-16T23:10:32.801Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Google LLC Products: Asylo Problem Types: CWE-823 Description: An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
CVE ID: CVE-2021-22552 State: PUBLISHED Published: 2021-08-02T15:40:10.426091Z Last Updated: 2024-09-17T01:40:58.668Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Asylo Problem Types: CWE-126 Description: An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a Additional Analyst Notes: - CVE Program C
ttps://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
CVE ID: CVE-2021-22553 State: PUBLISHED Published: 2021-02-17T12:05:17.410116Z Last Updated: 2024-09-16T19:51:15.662Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Google LLC Products: Gerrit Problem Types: CWE-400 Description: Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/gerrit/issues/detail?id=13858
CVE ID: CVE-2021-22555 State: PUBLISHED Published: 2021-07-07T11:20:10.668Z Last Updated: 2025-10-21T23:25:41.821Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Linux Kernel Problem Types: CWE-787 Description: A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528 - https://git.kernel.org/pub/scm/linux/kernel/git/to
om/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d - http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html - https://security.netapp.com/advisory/ntap-20210805-0010/ - http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html - http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081
Security-Notice-LSN-0080-1.html - http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html - http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html - http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
CVE ID: CVE-2021-22556 State: PUBLISHED Published: 2022-05-03T15:50:11.000Z Last Updated: 2025-04-21T13:54:07.544Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Google LLC Products: Fuchsia Kernel Problem Types: CWE-190 Description: The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fuchsia.dev/whats-new/release-notes/f4-1 - https:
CVE Program Container: - CISA ADP Vulnrichment: References: - https://fuchsia.dev/whats-new/release-notes/f4-1 - https://fuchsia-review.googlesource.com/c/fuchsia/+/570881
CVE ID: CVE-2021-22557 State: PUBLISHED Published: 2021-10-04T10:10:10 Last Updated: 2024-08-03T18:44:14.145Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Google LLC Products: SLO Generator Problem Types: CWE-94 Description: SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/slo-generator/pull/173 - http://packetstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-E
github.com/google/slo-generator/pull/173 - http://packetstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-Execution.html
CVE ID: CVE-2021-22563 State: PUBLISHED Published: 2021-11-01T13:10:13.942562Z Last Updated: 2024-09-17T02:10:45.898Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Google LLC Products: libjxl Problem Types: CWE-126 Description: Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read access can either lead to a segfault, or rendering splines based on other process memory. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/757 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/issues/735 -
/pull/757 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/issues/735 - https://github.com/libjxl/libjxl/pull/757
CVE ID: CVE-2021-22564 State: PUBLISHED Published: 2021-11-01T13:10:15.502811Z Last Updated: 2024-09-17T00:21:49.352Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Google LLC Products: libjxl Problem Types: CWE-122 Description: For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups out of order the decoder can perform an out of bounds copy of image pixels from an image buffer in the heap to another. This copy can occur when processing the right or bottom edges of the image, but only when groups are processed in certain order. Groups can be processed out of order in multi-thr
ges of the image, but only when groups are processed in certain order. Groups can be processed out of order in multi-threaded decoding environments with heavy thread load but also with images that contain the groups in an arbitrary order in the file. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/775 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/pull/775 - https://github.com/libjxl/libjxl/issues/708
CVE ID: CVE-2021-22565 State: PUBLISHED Published: 2021-12-09T12:55:10.778079Z Last Updated: 2024-09-16T17:53:56.557Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Google LLC Products: Google Exposure-notifications-verification-server Problem Types: CWE-284 Description: An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/exposure-notifications-verification-server/secur
Notes: - CVE Program Container: References: - https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v - https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2
CVE ID: CVE-2021-22566 State: PUBLISHED Published: 2022-01-18T14:10:10 Last Updated: 2024-08-03T18:44:14.082Z Vendors: Google LLC Products: Fuchsia Problem Types: CWE-275 Description: An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from user-mode. An incorrect setting of PXN bits within mmu_flags_to_s1_pte_attr lead to unprivileged executable pages being mapped as executable from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pag
le from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pages from kernel-mode. Typically this allows a potential attacker to circumvent a mitigation, making exploitation of potential kernel-mode vulnerabilities easier. We recommend updating kernel beyond commit 7d731b4e9599088ac3073956933559da7bca6a00 and rebuilding. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fuchsia.googlesource.com/fuchsia/+/7d731b4e9599088ac3073956933559da7bca6a00
CVE ID: CVE-2021-22567 State: PUBLISHED Published: 2022-01-05T10:55:11.851Z Last Updated: 2025-04-21T13:57:18.231Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Google LLC Products: Dart SDK Problem Types: CWE-284 Description: Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dart-lang
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md - https://github.com/dart-lang/sdk/commit/52519ea8eb4780c468c4c2ed00e7c8046ccfed41