Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1363/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1360/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1358/
CVE ID: CVE-2021-43273 State: PUBLISHED Published: 2021-11-14T20:48:28 Last Updated: 2024-08-04T03:55:27.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1281/ - https:
s: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1281/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1291/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1357/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1351/
CVE ID: CVE-2021-43274 State: PUBLISHED Published: 2021-11-14T20:49:48 Last Updated: 2024-08-04T03:55:27.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43275 State: PUBLISHED Published: 2021-11-14T20:50:17 Last Updated: 2024-08-04T03:55:28.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43276 State: PUBLISHED Published: 2021-11-14T20:51:18 Last Updated: 2024-08-04T03:55:28.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43277 State: PUBLISHED Published: 2021-11-14T20:52:12 Last Updated: 2024-08-04T03:55:28.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43278 State: PUBLISHED Published: 2021-11-14T20:52:49 Last Updated: 2024-08-04T03:55:28.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Out-of-bounds Read vulnerability exists in the OBJ file reading procedure in Open Design Alliance Drawings SDK before 2022.11. The lack of validating the input length can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-43279 State: PUBLISHED Published: 2021-11-14T20:53:15 Last Updated: 2024-08-04T03:55:28.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1337/
CVE ID: CVE-2021-43280 State: PUBLISHED Published: 2021-11-14T20:58:03 Last Updated: 2024-08-04T03:55:28.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-
tainer: References: - https://www.opendesign.com/security-advisories - https://www.zerodayinitiative.com/advisories/ZDI-21-1356/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1343/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1355/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1345/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1341/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1340/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1342/
CVE ID: CVE-2021-43281 State: PUBLISHED Published: 2021-11-04T17:42:34 Last Updated: 2024-08-04T03:55:28.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p
CVE ID: CVE-2021-43282 State: PUBLISHED Published: 2021-11-30T18:21:09 Last Updated: 2024-08-04T03:55:28.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC address. The device default Wi-Fi password corresponds to the last 4 bytes of the MAC address of its 2.4 GHz network interface controller (NIC). An attacker within scanning range of the Wi-Fi network can thus scan for Wi-Fi networks to obtain the default key. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/our-research/?re
ult key. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/our-research/?research=Technical+advisories - https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE ID: CVE-2021-43283 State: PUBLISHED Published: 2021-11-30T18:22:00 Last Updated: 2024-08-04T03:55:28.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.
the device with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/our-research/?research=Technical+advisories - https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE ID: CVE-2021-43284 State: PUBLISHED Published: 2021-11-30T18:23:13 Last Updated: 2024-08-04T03:55:28.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH (regardless of whether the admin password was changed on the web interface). Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/our-research/?research=Technical+advisories - https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi
advisories - https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284/
CVE ID: CVE-2021-43286 State: PUBLISHED Published: 2022-04-14T12:55:51 Last Updated: 2024-08-04T03:55:28.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.gocd.org/releases/#21-3-0 - https://github.com/gocd/gocd/commit/2b77b533abcbb79c8fc758dec9984305dc1ade42 - https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676b - https://blog.sonarsource.com/gocd-v
e42 - https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676b - https://blog.sonarsource.com/gocd-vulnerability-chain
CVE ID: CVE-2021-43287 State: PUBLISHED Published: 2022-04-14T11:52:39 Last Updated: 2024-08-04T03:55:28.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: References: - https://www.gocd.org/releases/#21-3-0 - https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c - https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
CVE ID: CVE-2021-43288 State: PUBLISHED Published: 2022-04-14T12:55:37 Last Updated: 2024-08-04T03:55:27.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. Additional Analyst Notes: - CVE Program Container: References: - https://www.gocd.org/releases/#21-3-0 - https://github.com/gocd/gocd/commit/f5c1d2aa9ab302a97898a6e4b16218e64fe8e9e4 - https://blog.sonarsource.com/gocd-vulnerability-chain
CVE ID: CVE-2021-43289 State: PUBLISHED Published: 2022-04-14T12:55:29 Last Updated: 2024-08-04T03:55:28.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename. Additional Analyst Notes: - CVE Program Container: References: - https://www.gocd.org/releases/#21-3-0 - https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595 - https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f - https://blog.sonarsource.com/gocd-vulnerability-chain
CVE ID: CVE-2021-43290 State: PUBLISHED Published: 2022-04-14T12:55:19 Last Updated: 2024-08-04T03:55:28.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control. Additional Analyst Notes: - CVE Program Container: References: - https://www.gocd.org/releases/#21-3-0 - https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595 - https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc8
it/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595 - https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f - https://blog.sonarsource.com/gocd-vulnerability-chain
CVE ID: CVE-2021-43293 State: PUBLISHED Published: 2021-11-04T17:51:51 Last Updated: 2024-08-04T03:55:28.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF). Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/4409326330003
CVE ID: CVE-2021-43294 State: PUBLISHED Published: 2021-11-30T18:38:26 Last Updated: 2024-08-04T03:55:28.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/support-center/readme.html#11016
CVE ID: CVE-2021-43295 State: PUBLISHED Published: 2021-11-30T18:39:37 Last Updated: 2024-08-04T03:55:28.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/support-center/readme.html#11016
CVE ID: CVE-2021-43296 State: PUBLISHED Published: 2021-11-30T18:40:54 Last Updated: 2024-08-04T03:55:28.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/support-center/readme.html#11016
CVE ID: CVE-2021-43297 State: PUBLISHED Published: 2022-01-10T15:25:48 Last Updated: 2024-08-04T03:55:28.375Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-502 Description: A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo
ects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww
CVE ID: CVE-2021-43298 State: PUBLISHED Published: 2022-01-25T19:11:17 Last Updated: 2024-08-04T03:55:28.938Z Vendors: embedthis Products: goahead Problem Types: CWE-208 Description: The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/embedthis/goahead/issues/304
CVE ID: CVE-2021-43299 State: PUBLISHED Published: 2022-02-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:19.878Z Vendors: teluu Products: pjsip Problem Types: CWE-121 Description: Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/secur
022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43300 State: PUBLISHED Published: 2022-02-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:20.885Z Vendors: teluu Products: pjsip Problem Types: CWE-121 Description: Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/sec
/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43301 State: PUBLISHED Published: 2022-02-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:21.847Z Vendors: teluu Products: pjsip Problem Types: CWE-121 Description: Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/s
ce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43302 State: PUBLISHED Published: 2022-02-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:22.782Z Vendors: teluu Products: pjsip Problem Types: CWE-125 Description: Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 -
l - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43303 State: PUBLISHED Published: 2022-02-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:23.740Z Vendors: teluu Products: pjsip Problem Types: CWE-120 Description: Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-anno
34v-c7r9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43304 State: PUBLISHED Published: 2022-03-14T00:00:00 Last Updated: 2024-08-04T03:55:28.381Z Vendors: yandex Products: clickhouse Problem Types: CWE-122 Description: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms - https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html
CVE ID: CVE-2021-43305 State: PUBLISHED Published: 2022-03-14T00:00:00 Last Updated: 2024-08-04T03:55:29.085Z Vendors: yandex Products: clickhouse Problem Types: CWE-122 Description: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a different wildCopy call. Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/7-rce-and-do
rent wildCopy call. Additional Analyst Notes: - CVE Program Container: References: - https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms - https://lists.debian.org/debian-lts-announce/2022/11/msg00002.html
CVE ID: CVE-2021-43306 State: PUBLISHED Published: 2022-06-01T16:47:27.576755Z Last Updated: 2024-09-16T23:56:26.165Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: jquery-validation Products: jquery-validation Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/jquery-validation-redos-xray-211348/
CVE ID: CVE-2021-43307 State: PUBLISHED Published: 2022-06-01T16:47:38.625940Z Last Updated: 2024-09-17T00:35:50.984Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: semver-regex Products: semver-regex Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/