Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
kage-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://groups.google.com/g/golang-announce/c/0fM21h43arc - https://security.netapp.com/advisory/ntap-20211210-0003/ - https://security.gentoo.org/glsa/202208-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
CVE ID: CVE-2021-41773 State: PUBLISHED Published: 2021-10-05T08:40:12.000Z Last Updated: 2025-10-21T23:25:30.864Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-22 Description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be ex
ipts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E - https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E - http://
s.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/05/2 - http://www.openwall.com/lists/oss-security/2021/10/07/1 - https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/07/6 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ - http://www.openwall.com/lists/oss-security/2021/1
content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ - http://www.openwall.com/lists/oss-security/2021/10/08/1 - https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/10/08/2 - http://www.openwall.com/lists/oss-security/2021/10/08/3 - http://www.openwall.com/lists/oss-security/2021/10/08/4 - http://www.openwall.com/lists/oss-security/2021/10/08/6 - http://www.openwall.com/lists/oss-security/2021/10/08/5 - http://www.openwall.com/lists/oss-security/2021/10/09/1 - http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html - http:
ecurity/2021/10/09/1 - http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html - http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html - http://www.openwall.com/lists/oss-security/2021/10/11/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ - http://www.openwall.com/lists/oss-security/2021/10/15/3 - http://www.openwall.com/lists/oss-security/2021/10/16/1 - https://www.oracle.com/security
ts/oss-security/2021/10/15/3 - http://www.openwall.com/lists/oss-security/2021/10/16/1 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20211029-0009/ - http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html - http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2021-41780 State: PUBLISHED Published: 2022-08-29T04:54:27 Last Updated: 2024-08-04T03:15:29.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41781 State: PUBLISHED Published: 2022-08-29T04:54:23 Last Updated: 2024-08-04T03:15:29.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41782 State: PUBLISHED Published: 2022-08-29T04:54:17 Last Updated: 2024-08-04T03:15:29.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41783 State: PUBLISHED Published: 2022-08-29T04:54:11 Last Updated: 2024-08-04T03:15:29.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41784 State: PUBLISHED Published: 2022-08-29T04:54:05 Last Updated: 2024-08-04T03:15:29.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41785 State: PUBLISHED Published: 2022-08-29T04:53:56 Last Updated: 2024-08-04T03:15:29.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2021-41788 State: PUBLISHED Published: 2021-12-25T23:18:30 Last Updated: 2024-08-04T03:15:29.306Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:H/AV:N/A:L/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: MediaTek microchips, as used in NETGEAR devices through 2021-12-13 and other devices, mishandle attempts at Wi-Fi authentication flooding. (Affected Chipsets MT7603E, MT7612, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 7.4.0.0). Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000064369/Security-Advisory-for-WiFi-Authentication-Flooding-Vulnerabilities-on-Multiple-Products-PSV-2021-029
tgear.com/000064369/Security-Advisory-for-WiFi-Authentication-Flooding-Vulnerabilities-on-Multiple-Products-PSV-2021-0299-PSV-2021-0301 - https://corp.mediatek.com/product-security-bulletin/January-2022
CVE ID: CVE-2021-41789 State: PUBLISHED Published: 2022-01-04T15:54:41 Last Updated: 2024-08-04T03:15:29.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of service from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20190426015; Issue ID: GN20190426015. Additional Analyst Notes: - CVE Program Container: References: - https://corp.mediatek.com/product-security-bulletin/January-2022
CVE ID: CVE-2021-41790 State: PUBLISHED Published: 2021-10-21T08:49:01 Last Updated: 2024-08-04T03:15:29.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment. Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/ - https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md
CVE ID: CVE-2021-41791 State: PUBLISHED Published: 2021-10-21T08:49:13 Last Updated: 2024-08-04T03:22:24.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features). Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/ - https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md
CVE ID: CVE-2021-41792 State: PUBLISHED Published: 2021-10-21T08:49:23 Last Updated: 2024-08-04T03:22:24.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/ - https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md
CVE ID: CVE-2021-41794 State: PUBLISHED Published: 2021-10-07T14:57:14 Last Updated: 2024-08-04T03:22:24.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then, 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer. Additional Analyst Notes: - CVE Program Container: Refer
bytes to copy from the source buffer to the destination buffer. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/10/06/technical-advisory-open5gs-stack-buffer-overflow-during-pfcp-session-establishment-on-upf-cve-2021-41794
CVE ID: CVE-2021-41795 State: PUBLISHED Published: 2021-09-29T20:04:52 Last Updated: 2024-08-04T03:22:24.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vault items that would normally be fillable by the user on that web page. These items are usernames and passwords for vault items associated with its domain, usernames and passwords without a domain association, credit cards, and contact items. (1Password must be unlocked for these items to be
sswords without a domain association, credit cards, and contact items. (1Password must be unlocked for these items to be accessible, but no further user interaction is required.) Additional Analyst Notes: - CVE Program Container: References: - https://support.1password.com/kb/202109/
CVE ID: CVE-2021-41796 State: REJECTED Published: 2021-10-12T16:48:07 Last Updated: 2021-10-12T16:48:07 Description: No description available.
CVE ID: CVE-2021-41797 State: REJECTED Published: 2021-10-12T16:49:09 Last Updated: 2021-10-12T16:49:09 Description: No description available.
CVE ID: CVE-2021-41798 State: PUBLISHED Published: 2021-10-11T00:00:00 Last Updated: 2024-08-04T03:22:24.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T285515 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fed
g/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/ - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-41799 State: PUBLISHED Published: 2021-10-11T00:00:00 Last Updated: 2024-08-04T03:22:24.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backlinks) can cause a full table scan. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T290394 - https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I
SEWVFV5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/ - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-41800 State: PUBLISHED Published: 2021-10-11T00:00:00 Last Updated: 2024-08-04T03:22:24.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T284419 - https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/ - https://github.com/wikimedia/mediawiki/commit/781caf83dba90c
ts.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/ - https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/ - https://security.gentoo.org/glsa/202305-24
CVE ID: CVE-2021-41801 State: PUBLISHED Published: 2021-10-11T07:40:22 Last Updated: 2024-08-04T03:22:24.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog) Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T279090 - https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
CVE ID: CVE-2021-41802 State: PUBLISHED Published: 2021-10-08T17:00:01 Last Updated: 2024-08-04T03:22:24.278Z Severity: LOW (CVSS 2.9 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-
ces: - https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/ - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2021-41803 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-27T15:22:09.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hashicorp.com/blog/category/consul - https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 - https://lists.fedoraproject.org/archives/li
022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
CVE ID: CVE-2021-41805 State: PUBLISHED Published: 2021-12-12T04:51:21 Last Updated: 2024-08-04T03:22:24.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871 - https://security.netapp.co
m/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871 - https://security.netapp.com/advisory/ntap-20211229-0007/
CVE ID: CVE-2021-41807 State: PUBLISHED Published: 2022-01-18T16:51:50.929804Z Last Updated: 2024-09-16T21:02:53.545Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: M-Files Products: M-Files Server, M-Files Web Problem Types: CWE-307 Description: Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier. Additional Analyst Notes: - CVE Program Container: References: - https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41807/
CVE ID: CVE-2021-41808 State: PUBLISHED Published: 2022-01-18T16:51:52.431113Z Last Updated: 2024-09-17T02:51:33.573Z Severity: LOW (CVSS 2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-532 Description: In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41808/
CVE ID: CVE-2021-41809 State: PUBLISHED Published: 2022-01-18T16:51:49.630407Z Last Updated: 2024-09-16T23:41:28.252Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-918 Description: SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities. Additional Analyst Notes: - CVE Program Container: References: - https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41809/
CVE ID: CVE-2021-41810 State: PUBLISHED Published: 2022-05-02T19:06:11.675159Z Last Updated: 2024-09-16T17:18:03.386Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-79 Description: Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable Additional Analyst Notes: - CVE Program Container: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/
CVE ID: CVE-2021-41816 State: PUBLISHED Published: 2022-02-06T00:00:00 Last Updated: 2024-08-04T03:22:24.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1328463 - https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/ - https://security-tracker.debian.org/tracker/CVE-2021-41816 -
1/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/ - https://security-tracker.debian.org/tracker/CVE-2021-41816 - https://security.netapp.com/advisory/ntap-20220303-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/ - https://security.gentoo.org/glsa/202401-27
CVE ID: CVE-2021-41817 State: PUBLISHED Published: 2022-01-01T00:00:00 Last Updated: 2024-08-04T03:22:24.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1254844 - https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/ - https://lists.fedorapro