Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-30350 State: PUBLISHED Published: 2022-06-14T10:11:11 Last Updated: 2024-08-03T22:32:40.535Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables Problem Types: Improper Authentication in Core Description: Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables Additional Analyst Notes: - CVE Program Container: References: -
er IOT, Snapdragon Industrial IOT, Snapdragon Wearables Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletin
CVE ID: CVE-2021-30351 State: PUBLISHED Published: 2022-01-03T07:26:13 Last Updated: 2024-08-03T22:32:41.020Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking Problem Types: Buffer Copy Without Checking Size of Input in Audio Description: An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon
er validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE ID: CVE-2021-30353 State: PUBLISHED Published: 2022-01-13T11:40:36 Last Updated: 2024-08-03T22:32:41.061Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables Problem Types: Reachable Assertion in Audio Description: Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables Addit
n Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/january-2022-bulletin
CVE ID: CVE-2021-30354 State: PUBLISHED Published: 2021-09-01T17:43:38 Last Updated: 2024-08-03T22:32:41.028Z Vendors: n/a Products: Amazon Kindle e-reader Problem Types: CWE-680 Description: Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function CJBig2Image::expand() and results in a memory corruption that leads to code execution when parsing a crafted PDF book. Additional Analyst Notes: - CVE Program Container: References: - https://research.checkpoint.com/2021/i-can-take-over-your-kindle/
CVE ID: CVE-2021-30355 State: PUBLISHED Published: 2021-09-01T18:04:18 Last Updated: 2024-08-03T22:32:41.007Z Vendors: n/a Products: Amazon Kindle e-reader Problem Types: CWE-269 Description: Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://research.checkpoint.com/2021/i-can-take-over-your-kindle/
CVE ID: CVE-2021-30356 State: PUBLISHED Published: 2021-04-22T17:37:06 Last Updated: 2024-08-03T22:32:40.978Z Vendors: n/a Products: Check Point Identity Agent Problem Types: CWE-59 Description: A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk134312
CVE ID: CVE-2021-30357 State: PUBLISHED Published: 2021-06-08T13:31:53 Last Updated: 2024-08-03T22:32:40.631Z Vendors: n/a Products: SSL Network Extender Client for Linux Problem Types: CWE-209 Description: SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk173513
CVE ID: CVE-2021-30358 State: PUBLISHED Published: 2021-10-19T13:32:46 Last Updated: 2024-08-03T22:32:41.139Z Vendors: n/a Products: Check Point Mobile Access Portal Agent Problem Types: CWE-78 Description: Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk142952 - https://supportcontent.checkpoint.com/solutions?id=sk175806
CVE ID: CVE-2021-30359 State: PUBLISHED Published: 2021-10-22T13:32:54 Last Updated: 2024-08-03T22:32:41.073Z Vendors: n/a Products: Check Point Harmony Browse and SandBlast Agent for Browsers Problem Types: CWE-427 Description: The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https:/
r folder, which runs with the admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk175968 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0007/MNDT-2021-0007.md
CVE ID: CVE-2021-30360 State: PUBLISHED Published: 2022-01-07T22:39:56 Last Updated: 2024-08-03T22:32:41.116Z Vendors: n/a Products: Check Point Remote Access Client Problem Types: CWE-427 Description: Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client privileges. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk176853 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/
supportcontent.checkpoint.com/solutions?id=sk176853 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0001/MNDT-2022-0001.md
CVE ID: CVE-2021-30361 State: PUBLISHED Published: 2022-05-11T16:42:52 Last Updated: 2024-08-03T22:32:41.127Z Vendors: n/a Products: Check Point Gaia Portal Problem Types: CWE-78 Description: The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk179128
CVE ID: CVE-2021-30369 State: REJECTED Published: N/A Last Updated: 2025-02-17T19:30:59.502Z Description: No description available.
CVE ID: CVE-2021-30454 State: PUBLISHED Published: 2021-04-07T21:20:18 Last Updated: 2024-08-03T22:32:40.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0051.html
CVE ID: CVE-2021-30455 State: PUBLISHED Published: 2021-04-07T21:20:07 Last Updated: 2024-08-03T22:32:41.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE ID: CVE-2021-30456 State: PUBLISHED Published: 2021-04-07T21:19:45 Last Updated: 2024-08-03T22:32:40.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in get_or_insert upon a panic of a user-provided f function. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE ID: CVE-2021-30457 State: PUBLISHED Published: 2021-04-07T21:19:55 Last Updated: 2024-08-03T22:32:40.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in remove_set upon a panic in a Drop impl. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0052.html
CVE ID: CVE-2021-30458 State: PUBLISHED Published: 2021-04-09T06:06:04 Last Updated: 2024-08-03T22:32:41.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T279451 - https://www.mediawiki.org/wiki/Parsoid - https://security.gentoo.org/glsa/202107-40
CVE ID: CVE-2021-30459 State: PUBLISHED Published: 2021-04-14T17:27:00 Last Updated: 2024-08-03T22:32:41.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jazzband/django-debug-toolbar/releases - https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj - https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-se
ebug-toolbar/security/advisories/GHSA-pghf-347x-c2gj - https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/
CVE ID: CVE-2021-30461 State: PUBLISHED Published: 2021-05-29T13:02:12 Last Updated: 2024-08-03T22:32:41.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value (which might contain PHP code) is injected into config/configuration.php. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory--voipmonitor-unauth-rce
CVE ID: CVE-2021-30462 State: PUBLISHED Published: 2021-04-08T13:54:15 Last Updated: 2024-08-03T22:32:40.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-vestacp-lpe-vulnerabilities/
CVE ID: CVE-2021-30463 State: PUBLISHED Published: 2021-04-08T13:54:00 Last Updated: 2024-08-03T22:32:41.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/ssd-advisory-vestacp-lpe-vulnerabilities/
CVE ID: CVE-2021-30464 State: PUBLISHED Published: 2021-04-20T18:29:53 Last Updated: 2024-08-03T22:32:41.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet port. Additional Analyst Notes: - CVE Program Container: References: - https://www.omicronenergy.com/en/support/product-security/ - https://www.omicronenergy.com/download/file/e81f23250097e7d5e1071dfbdb7f16d2/
CVE ID: CVE-2021-30465 State: PUBLISHED Published: 2021-05-27T00:00:00 Last Updated: 2024-08-03T22:32:40.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencontainers/runc/releases - http://www.openwall.com/lists/oss-security/2021/05/19/2 - http://www.openwall.com/lists/oss-security/2021/05/19/2 - ht
- http://www.openwall.com/lists/oss-security/2021/05/19/2 - http://www.openwall.com/lists/oss-security/2021/05/19/2 - https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/ - https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f - https://bugzilla.opensuse.org/show_bug.cgi?id=1185405 - https://security.netapp.com/advisory/ntap-20210708-0003/ - https://security.gentoo.org/gls
org/show_bug.cgi?id=1185405 - https://security.netapp.com/advisory/ntap-20210708-0003/ - https://security.gentoo.org/glsa/202107-26 - https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
CVE ID: CVE-2021-30468 State: PUBLISHED Published: 2021-06-16T12:00:18 Last Updated: 2024-08-03T22:32:41.089Z Vendors: Apache Software Foundation Products: Apache CXF Problem Types: CWE-400 Description: A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11. Additional Analyst Notes: - CVE Program Container: References: - http://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc - https://lists.apache.org/thread.html/r4a4b6bc0520b69
://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc - https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cusers.cxf.apache.org%3E - https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/06/16/2 - https://lists.apache.org/thread.html/r3f46ae38e4a6e80c069cdb320e0ce831b0a21a12ef0cc92c0943f34a%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/re5b2a2b77faa22684d47bd2ac662313
f0cc92c0943f34a%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/re5b2a2b77faa22684d47bd2ac6623135c615565328ff40a1ec705448%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/rac07822057521dccf33ab5d136e0e8c599a6e2c8ac75e44ffbdc6e07%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/re9e05c6cab5f0dcc827eba4e6fcf26fa0b493e7ca84d62c867a80d03%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737%40%3Ccommits.tomee.apache.org%3E -
ists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737%40%3Ccommits.tomee.apache.org%3E - https://lists.apache.org/thread.html/r4771084730c4cf6e59eda60b4407122c86f174eb750b24f610ba9ff4%40%3Ccommits.tomee.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210917-0002/ - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-30469 State: PUBLISHED Published: 2021-05-26T21:37:05 Last Updated: 2024-08-03T22:32:41.131Z Vendors: n/a Products: podofo Problem Types: CWE-416 Description: A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of service via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947433
CVE ID: CVE-2021-30470 State: PUBLISHED Published: 2021-05-26T21:37:28 Last Updated: 2024-08-03T22:32:41.012Z Vendors: n/a Products: podofo Problem Types: CWE-674 Description: A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType() functions can lead to a stack overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947436
CVE ID: CVE-2021-30471 State: PUBLISHED Published: 2021-05-26T21:38:04 Last Updated: 2024-08-03T22:32:41.095Z Vendors: n/a Products: podofo Problem Types: CWE-674 Description: A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a stack overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947441
CVE ID: CVE-2021-30472 State: PUBLISHED Published: 2021-05-26T21:38:26 Last Updated: 2024-08-03T22:32:41.103Z Vendors: n/a Products: podofo Problem Types: CWE-119 Description: A flaw was found in PoDoFo 0.9.7. A stack-based buffer overflow in PdfEncryptMD5Base::ComputeOwnerKey function in PdfEncrypt.cpp is possible because of a improper check of the keyLength value. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947458
CVE ID: CVE-2021-30473 State: PUBLISHED Published: 2021-05-06T00:00:00 Last Updated: 2024-08-03T22:32:41.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/aomedia/issues/detail?id=2998 - https://aomedia.googlesource.com/aom/+/4efe20e99dcd9b6f8eadc8de8acc825be7416578 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCI33HXH6YSOGC2LPE2REQLMIDH6US4/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html - https://www.debian.org/se
YSOGC2LPE2REQLMIDH6US4/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html - https://www.debian.org/security/2023/dsa-5490 - https://security.gentoo.org/glsa/202401-32
CVE ID: CVE-2021-30474 State: PUBLISHED Published: 2021-06-02T00:00:00 Last Updated: 2024-08-03T22:32:41.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/aomedia/issues/detail?id=3000 - https://aomedia.googlesource.com/aom/+/6e31957b6dc62dbc7d1bb70cd84902dd14c4bf2e - https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html - https://www.debian.org/security/2023/dsa-5490 - https://security.gentoo.org/glsa/202401-32
CVE ID: CVE-2021-30475 State: PUBLISHED Published: 2021-06-04T00:00:00 Last Updated: 2024-08-03T22:32:41.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/aomedia/issues/detail?id=2999 - https://aomedia.googlesource.com/aom/+/12adc723acf02633595a4d8da8345742729f46c0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCI33HXH6YSOGC2LPE2REQLMIDH6US4/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html - https://www.debian.org/security/2023/d
LMIDH6US4/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00003.html - https://www.debian.org/security/2023/dsa-5490 - https://security.gentoo.org/glsa/202401-32
CVE ID: CVE-2021-30476 State: PUBLISHED Published: 2021-04-22T16:23:20 Last Updated: 2024-08-03T22:32:41.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/terraform-provider-vault/issues/996 - https://discuss.hashicorp.com/t/hcsec-2021-11-terraform-s-vault-provider-did-not-correctly-configure-bound-labels-for-gcp-auth/23464/2
CVE ID: CVE-2021-30477 State: PUBLISHED Published: 2021-04-14T23:45:14 Last Updated: 2024-08-03T22:32:41.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE ID: CVE-2021-30478 State: PUBLISHED Published: 2021-04-14T23:47:27 Last Updated: 2024-08-03T22:32:41.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2021/04/14/zulip-server-3-4/
CVE ID: CVE-2021-30479 State: PUBLISHED Published: 2021-04-14T23:48:38 Last Updated: 2024-08-03T22:32:41.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.com/2021/04/14/zulip-server-3-4/