Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13601. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-940/
CVE ID: CVE-2021-34858 State: PUBLISHED Published: 2022-01-13T21:42:55 Last Updated: 2024-08-04T00:26:54.592Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TeamViewer Products: TeamViewer Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure.
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13606. Additional Analyst Notes: - CVE Program Container: References: - https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1 - https://www.zerodayinitiative.com/advisories/ZDI-21-1001/
CVE ID: CVE-2021-34859 State: PUBLISHED Published: 2021-10-25T17:10:44 Last Updated: 2024-08-04T00:26:54.646Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TeamViewer Products: TeamViewer Problem Types: CWE-119 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An at
sults from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13697. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1003/ - https://community.teamviewer.com/English/discussion/117794/august-updates-security-patches/p1
CVE ID: CVE-2021-34860 State: PUBLISHED Published: 2021-10-25T17:10:45 Last Updated: 2024-08-04T00:26:54.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: D-Link Products: DAP-2020 Problem Types: CWE-22 Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to the webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can
results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-12103. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 - https://www.zerodayinitiative.com/advisories/ZDI-21-976/
CVE ID: CVE-2021-34861 State: PUBLISHED Published: 2021-10-25T17:10:47 Last Updated: 2024-08-04T00:26:54.669Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2020 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. A
ack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12104. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 - https://www.zerodayinitiative.com/advisories/ZDI-21-977/
CVE ID: CVE-2021-34862 State: PUBLISHED Published: 2021-10-25T17:10:49 Last Updated: 2024-08-04T00:26:54.205Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2020 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based
from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13270. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 - https://www.zerodayinitiative.com/advisories/ZDI-21-978/
CVE ID: CVE-2021-34863 State: PUBLISHED Published: 2021-10-25T17:10:50 Last Updated: 2024-08-04T00:26:54.606Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DAP-2020 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based
from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13271. Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 - https://www.zerodayinitiative.com/advisories/ZDI-21-979/
CVE ID: CVE-2021-34864 State: PUBLISHED Published: 2021-10-25T17:10:52 Last Updated: 2024-08-04T00:26:54.660Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-284 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the WinAppHelper component. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate priv
. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13543. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1000/
CVE ID: CVE-2021-34865 State: PUBLISHED Published: 2022-01-25T15:30:34 Last Updated: 2024-08-04T00:26:54.213Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: Multiple Routers Problem Types: CWE-287 Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate priv
rrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-13313. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1051/ - https://kb.netgear.com/000063955/Security-Advisory-for-Authentication-Bypass-Vulnerability-on-Some-Routers-PSV-2021-0083?article=000063955
CVE ID: CVE-2021-34866 State: PUBLISHED Published: 2022-01-25T15:30:36 Last Updated: 2024-08-04T00:26:54.201Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-843 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An a
from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1148/ - https://security.netapp.com/advisory/ntap-20220217-0008/
CVE ID: CVE-2021-34867 State: PUBLISHED Published: 2022-01-25T15:30:37 Last Updated: 2024-08-04T00:26:54.586Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-789 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allo
issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13672. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-1055/
CVE ID: CVE-2021-34868 State: PUBLISHED Published: 2022-01-25T15:30:39 Last Updated: 2024-08-04T00:26:54.683Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-789 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory alloc
issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13712. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-1056/
CVE ID: CVE-2021-34869 State: PUBLISHED Published: 2022-01-25T15:30:40 Last Updated: 2024-08-04T00:26:54.668Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-789 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory alloc
issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13797. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/125013 - https://www.zerodayinitiative.com/advisories/ZDI-21-1057/
CVE ID: CVE-2021-34870 State: PUBLISHED Published: 2022-01-25T15:30:42 Last Updated: 2024-08-04T00:26:54.590Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NETGEAR Products: XR1000 Problem Types: CWE-306 Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leadi
ion required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1058/ - https://kb.netgear.com/000063967/Security-Advisory-for-a-Security-Misconfiguration-Vulnerability-on-the-XR1000-PSV-2021-0101
CVE ID: CVE-2021-34871 State: PUBLISHED Published: 2022-01-13T21:42:56 Last Updated: 2024-08-04T00:26:54.583Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-122 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An at
from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14695. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1459/ - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
CVE ID: CVE-2021-34872 State: PUBLISHED Published: 2022-01-13T21:42:57 Last Updated: 2024-08-04T00:26:54.591Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can lev
from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14737. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1462/ - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0014
CVE ID: CVE-2021-34873 State: PUBLISHED Published: 2022-01-13T21:42:59 Last Updated: 2024-08-04T00:26:54.669Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute
PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14696. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1460/ - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0003
CVE ID: CVE-2021-34874 State: PUBLISHED Published: 2022-01-13T21:43:00 Last Updated: 2024-08-04T00:26:54.701Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-119 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of 3DS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attac
ts from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14736. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1461/ - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004
CVE ID: CVE-2021-34875 State: PUBLISHED Published: 2022-01-13T21:43:01 Last Updated: 2024-08-04T00:26:54.653Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute
3DS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14827. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0004 - https://www.zerodayinitiative.com/advisories/ZDI-21-1463/
CVE ID: CVE-2021-34876 State: PUBLISHED Published: 2022-01-13T21:43:03 Last Updated: 2024-08-04T00:26:54.587Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute c
T file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14828. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-1464/ - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE ID: CVE-2021-34877 State: PUBLISHED Published: 2022-01-13T21:43:04 Last Updated: 2024-08-04T00:26:54.660Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute c
T file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14829. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005 - https://www.zerodayinitiative.com/advisories/ZDI-21-1465/
CVE ID: CVE-2021-34878 State: PUBLISHED Published: 2022-01-13T21:43:05 Last Updated: 2024-08-04T00:26:54.697Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute c
T file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14830. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005 - https://www.zerodayinitiative.com/advisories/ZDI-21-1466/