alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-3304 (published 2021-01-26)
Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: sagemcom
Affected products: f\@st_3686, f\@st_3686_firmware
CVE-2021-33040 (published 2022-01-17)
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: futurepress
Affected products: epub.js
CVE-2021-33041 (published 2021-05-17)
vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: vmd_project
Affected products: vmd
CVE-2021-33044 (published 2021-09-15)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: dahuasecurity
Affected products: ipc-hum7xxx, ipc-hum7xxx_firmware, ipc-hx3xxx, ipc-hx3xxx_firmware, ipc-hx5xxx, ipc-hx5xxx_firmware, sd1a1, sd1a1_firmware, sd22, sd22_firmware, sd49, sd49_firmware, sd50, sd50_firmware, sd52c, sd52c_firmware, sd6al, sd6al_firmware, tpc-bf1241, tpc-bf1241_firmware, tpc-bf2221, tpc-bf2221_firmware, tpc-bf5x01, tpc-bf5x01_firmware, tpc-bf5x21
Added to CISA KEV catalog: 2024-08-21
KEV required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2021-33045 (published 2021-09-15)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: dahuasecurity
Affected products: ipc-hum7xxx, ipc-hum7xxx_firmware, ipc-hx3xxx, ipc-hx3xxx_firmware, ipc-hx5xxx, ipc-hx5xxx_firmware, nvr-1xxx, nvr-1xxx_firmware, nvr-2xxx, nvr-2xxx_firmware, nvr-4xxx, nvr-4xxx_firmware, nvr-5xxx, nvr-5xxx_firmware, nvr-6xx, nvr-6xx_firmware, vth-542xh, vth-542xh_firmware, vto-65xxx, vto-65xxx_firmware, vto-75x95x, vto-75x95x_firmware, xvr-4x04, xvr-4x04_firmware, xvr-4x08
Added to CISA KEV catalog: 2024-08-21
KEV required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2021-33046 (published 2022-01-13)
Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: dahuasecurity
Affected products: asc2204c, asc2204c_firmware, hcvr7xxx, hcvr7xxx_firmware, hcvr8xxx, hcvr8xxx_firmware, ipc-hx1xxx, ipc-hx1xxx_firmware, ipc-hx2xxx, ipc-hx2xxx_firmware, ipc-hx3xxx, ipc-hx3xxx_firmware, ipc-hx5\(4\)\(3\)xxx, ipc-hx5\(4\)\(3\)xxx_firmware, ipc-hx5xxx, ipc-hx5xxx_firmware, nvr1xxx, nvr1xxx_firmware, nvr2xxx, nvr2xxx_firmware, nvr4xxx, nvr4xxx_firmware, nvr5xxx, nvr5xxx_firmware, sd1a1
CVE-2021-3305 (published 2022-10-18)
Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: feishu
Affected products: feishu
CVE-2021-33054 (published 2021-06-04)
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-347
Affected vendors: debian, inverse
Affected products: debian_linux, sogo
CVE-2021-33055 (published 2021-08-30)
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: microsoft, zohocorp
Affected products: manageengine_adselfservice_plus, windows
CVE-2021-33056 (published 2021-08-12)
Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-444
Affected vendors: linphone
Affected products: belle-sip
CVE-2021-33057 (published 2022-07-26)
The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: tencent
Affected products: qq
CVE-2021-33058 (published 2021-11-17)
Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: administrative_tools_for_intel_network_adapters
CVE-2021-33059 (published 2021-11-17)
Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: administrative_tools_for_intel_network_adapters
CVE-2021-33060 (published 2022-08-18)
Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel, netapp
Affected products: aff_a200, aff_a200_firmware, aff_a220, aff_a220_firmware, aff_a250, aff_a250_firmware, aff_a300, aff_a300_firmware, aff_a320, aff_a320_firmware, aff_a400, aff_a400_firmware, aff_a700, aff_a700_firmware, aff_a700s, aff_a700s_firmware, aff_a800, aff_a800_firmware, aff_a900, aff_a900_firmware, aff_c190, aff_c190_firmware, fas2600, fas2600_firmware, fas2700
CVE-2021-33061 (published 2022-02-09)
Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: 82599eb, 82599eb_firmware, 82599en, 82599en_firmware, 82599es, 82599es_firmware
CVE-2021-33062 (published 2021-11-17)
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: vtune_profiler
CVE-2021-33063 (published 2021-11-17)
Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: intel, microsoft
Affected products: realsense_d400_series_universal_windows_platform_driver, windows_10
CVE-2021-33064 (published 2022-11-11)
Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: system_studio
CVE-2021-33068 (published 2022-02-09)
Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: intel, netapp
Affected products: active_management_technology_firmware, cloud_backup
CVE-2021-33069 (published 2022-05-12)
Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33071 (published 2021-11-17)
Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: oneapi_rendering_toolkit
CVE-2021-33073 (published 2021-11-17)
Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: intel
Affected products: distribution_of_openvino_toolkit
CVE-2021-33074 (published 2022-05-12)
Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33075 (published 2022-05-12)
Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33076 (published 2022-09-20)
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: ssd_600p, ssd_600p_firmware, ssd_660p, ssd_660p_firmware, ssd_665p, ssd_665p_firmware, ssd_670p, ssd_670p_firmware, ssd_700p, ssd_700p_firmware, ssd_760p, ssd_760p_firmware, ssd_d3-s4510_m.2, ssd_d3-s4510_m.2_firmware, ssd_d3-s4610_m.2, ssd_d3-s4610_m.2_firmware, ssd_d5-p4326, ssd_d5-p4326_firmware, ssd_d5-p5316, ssd_d5-p5316_firmware, ssd_d7_p5510, ssd_d7_p5510_firmware, ssd_d7_p5600, ssd_d7_p5600_firmware, ssd_dc_d4512
CVE-2021-33077 (published 2022-05-12)
Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33078 (published 2022-05-12)
Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33079 (published 2022-09-20)
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-693
Affected vendors: intel
Affected products: ssd_600p, ssd_600p_firmware, ssd_660p, ssd_660p_firmware, ssd_665p, ssd_665p_firmware, ssd_670p, ssd_670p_firmware, ssd_700p, ssd_700p_firmware, ssd_760p, ssd_760p_firmware, ssd_d3-s4510_m.2, ssd_d3-s4510_m.2_firmware, ssd_d3-s4610_m.2, ssd_d3-s4610_m.2_firmware, ssd_d5-p4326, ssd_d5-p4326_firmware, ssd_d5-p5316, ssd_d5-p5316_firmware, ssd_d7_p5510, ssd_d7_p5510_firmware, ssd_d7_p5600, ssd_d7_p5600_firmware, ssd_dc_d4512
CVE-2021-3308 (published 2021-01-26)
An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: fedoraproject, xen
Affected products: fedora, xen
CVE-2021-33080 (published 2022-05-12)
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-212
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33081 (published 2022-09-20)
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-693
Affected vendors: intel
Affected products: ssd_600p, ssd_600p_firmware, ssd_660p, ssd_660p_firmware, ssd_665p, ssd_665p_firmware, ssd_670p, ssd_670p_firmware, ssd_700p, ssd_700p_firmware, ssd_760p, ssd_760p_firmware, ssd_d3-s4510_m.2, ssd_d3-s4510_m.2_firmware, ssd_d3-s4610_m.2, ssd_d3-s4610_m.2_firmware, ssd_d5-p4326, ssd_d5-p4326_firmware, ssd_d5-p5316, ssd_d5-p5316_firmware, ssd_d7_p5510, ssd_d7_p5510_firmware, ssd_d7_p5600, ssd_d7_p5600_firmware, ssd_dc_d4512
CVE-2021-33082 (published 2022-05-12)
Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-212
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33083 (published 2022-05-12)
Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow an privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: intel
Affected products: optane_memory_h10_with_solid_state_storage, optane_memory_h10_with_solid_state_storage_firmware, optane_memory_h20_with_solid_state_storage, optane_memory_h20_with_solid_state_storage_firmware, optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, optane_ssd_dc_p4800x, optane_ssd_dc_p4800x_firmware, optane_ssd_dc_p4801x, optane_ssd_dc_p4801x_firmware, optane_ssd_p5800x, optane_ssd_p5800x_firmware
CVE-2021-33086 (published 2021-11-17)
Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: nuc_10_performance_kit_nuc10i3fnh, nuc_10_performance_kit_nuc10i3fnh_firmware, nuc_10_performance_kit_nuc10i3fnhf, nuc_10_performance_kit_nuc10i3fnhf_firmware, nuc_10_performance_kit_nuc10i3fnhfa, nuc_10_performance_kit_nuc10i3fnhfa_firmware, nuc_10_performance_kit_nuc10i3fnhja, nuc_10_performance_kit_nuc10i3fnhja_firmware, nuc_10_performance_kit_nuc10i3fnk, nuc_10_performance_kit_nuc10i3fnk_firmware, nuc_10_performance_kit_nuc10i5fnh, nuc_10_performance_kit_nuc10i5fnh_firmware, nuc_10_performance_kit_nuc10i5fnhca, nuc_10_performance_kit_nuc10i5fnhca_firmware, nuc_10_performance_kit_nuc10i5fnhf, nuc_10_performance_kit_nuc10i5fnhf_firmware, nuc_10_performance_kit_nuc10i5fnhj, nuc_10_performance_kit_nuc10i5fnhj_firmware, nuc_10_performance_kit_nuc10i5fnhja, nuc_10_performance_kit_nuc10i5fnhja_firmware, nuc_10_performance_kit_nuc10i5fnk, nuc_10_performance_kit_nuc10i5fnk_firmware, nuc_10_performance_kit_nuc10i5fnkp, nuc_10_performance_kit_nuc10i5fnkp_firmware, nuc_10_performance_kit_nuc10i5fnkpa
CVE-2021-33087 (published 2021-11-17)
Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710, nuc_m15_laptop_kit_management_engine_driver_pack
CVE-2021-33088 (published 2021-11-17)
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_integrated_sensor_hub_driver_pack, nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710
CVE-2021-33089 (published 2021-11-17)
Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before version 1.78.4.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: nuc_hdmi_firmware_update_tool, nuc_kit_nuc8i3be, nuc_kit_nuc8i5be, nuc_kit_nuc8i7be
CVE-2021-3309 (published 2021-01-26)
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: wekan_project
Affected products: wekan
CVE-2021-33090 (published 2021-11-17)
Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: nuc10i3fn, nuc10i5fn, nuc10i7fn, nuc_hdmi_firmware_update_tool
CVE-2021-33091 (published 2021-11-17)
Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_audio_driver_pack, nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710
CVE-2021-33092 (published 2021-11-17)
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_hid_event_filter_driver_pack, nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710
CVE-2021-33093 (published 2021-11-17)
Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710, nuc_m15_laptop_kit_serial_io_driver_pack
CVE-2021-33094 (published 2021-11-17)
Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_keyboard_led_service_driver_pack, nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710
CVE-2021-33095 (published 2021-11-17)
Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-428
Affected vendors: intel
Affected products: nuc_m15_laptop_kit_keyboard_led_service_driver_pack, nuc_m15_laptop_kit_lapbc510, nuc_m15_laptop_kit_lapbc710
CVE-2021-33096 (published 2022-02-09)
Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-668
Affected vendors: intel
Affected products: 82599eb, 82599eb_firmware, 82599en, 82599en_firmware, 82599es, 82599es_firmware
CVE-2021-33097 (published 2021-11-17)
Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: intel
Affected products: crypto_api_toolkit_for_intel_sgx
CVE-2021-33098 (published 2021-11-17)
Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: ethernet_500_series_controllers_driver, ethernet_connection_x540, ethernet_connection_x550, ethernet_connection_x557
CVE-2021-3310 (published 2021-03-10)
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: westerndigital
Affected products: my_cloud_dl2100, my_cloud_dl4100, my_cloud_ex2100, my_cloud_ex2_ultra, my_cloud_ex4100, my_cloud_mirror_gen_2, my_cloud_os, my_cloud_pr2100, my_cloud_pr4100
CVE-2021-33101 (published 2022-02-09)
Uncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: graphics_performance_analyzers
CVE-2021-33103 (published 2022-05-12)
Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1, core_i3-1005g1_firmware, core_i3-10100, core_i3-10100_firmware, core_i3-10100e, core_i3-10100e_firmware, core_i3-10100f, core_i3-10100f_firmware, core_i3-10100t, core_i3-10100t_firmware, core_i3-10100te, core_i3-10100te_firmware, core_i3-10100y, core_i3-10100y_firmware, core_i3-10105, core_i3-10105_firmware, core_i3-10105f, core_i3-10105f_firmware, core_i3-10105t, core_i3-10105t_firmware, core_i3-10110u
CVE-2021-33104 (published 2023-02-16)
Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: one_boot_flash_update
CVE-2021-33105 (published 2022-02-09)
Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version 21.10 may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: intel
Affected products: core_i5-8305g, core_i5-8305g_firmware, core_i7-8706g, core_i7-8706g_firmware
CVE-2021-33106 (published 2021-11-17)
Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: intel
Affected products: safestring_library
CVE-2021-33107 (published 2022-02-09)
Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx before versions 11.0.0.0012, 12.0.0.0011, 14.0.0.0004 and 15.0.0.0004 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: intel
Affected products: active_management_technology_software_development_kit, b150, b250, b460, b560, c232, c236, c242, c246, c422, c621, c621a, c622, c624, c625, c626, c627, c627a, c628, c629, c629a, celeron_4205u, celeron_4305u, celeron_4305ue, cm236
CVE-2021-33108 (published 2022-05-12)
Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: in-band_manageability
CVE-2021-3311 (published 2021-02-05)
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: octobercms
Affected products: october
CVE-2021-33110 (published 2022-02-09)
Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel, microsoft
Affected products: ac_1550_firmware, ac_3165_firmware, ac_3168_firmware, ac_7265_firmware, ac_8260_firmware, ac_8265_firmware, ac_9260_firmware, ac_9461_firmware, ac_9462_firmware, ac_9560_firmware, ax1650_firmware, ax1675_firmware, ax200_firmware, ax201_firmware, ax210_firmware, windows_10, windows_11
CVE-2021-33113 (published 2022-02-09)
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel, microsoft
Affected products: ac_1550_firmware, ac_3165_firmware, ac_3168_firmware, ac_7265_firmware, ac_8260_firmware, ac_8265_firmware, ac_9260_firmware, ac_9461_firmware, ac_9462_firmware, ac_9560_firmware, ax1650_firmware, ax1675_firmware, ax200_firmware, ax201_firmware, ax210_firmware, windows_10, windows_11
CVE-2021-33114 (published 2022-02-09)
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel, microsoft
Affected products: ac_1550_firmware, ac_3165_firmware, ac_3168_firmware, ac_7265_firmware, ac_8260_firmware, ac_8265_firmware, ac_9260_firmware, ac_9461_firmware, ac_9462_firmware, ac_9560_firmware, ax1650_firmware, ax1675_firmware, ax200_firmware, ax201_firmware, ax210_firmware, windows_10, windows_11
CVE-2021-33115 (published 2022-02-09)
Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: ac_3165, ac_3168, ac_7265, ac_8260, ac_8265, ac_9260, ac_9461, ac_9462, ac_9560, ax200, ax201, ax210, uefi_wifi_driver
CVE-2021-33117 (published 2022-05-12)
Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel, netapp
Affected products: bios, fas\/aff_bios, xeon_gold_5315y, xeon_gold_5317, xeon_gold_5318h, xeon_gold_5318n, xeon_gold_5318s, xeon_gold_5318y, xeon_gold_5320, xeon_gold_5320h, xeon_gold_5320t, xeon_gold_6312u, xeon_gold_6314u, xeon_gold_6326, xeon_gold_6328h, xeon_gold_6328hl, xeon_gold_6330, xeon_gold_6330h, xeon_gold_6330n, xeon_gold_6334, xeon_gold_6336y, xeon_gold_6338, xeon_gold_6338n, xeon_gold_6338t, xeon_gold_6342
CVE-2021-33118 (published 2021-11-17)
Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: serial_io_driver_for_intel_nuc_11_gen
CVE-2021-33119 (published 2022-02-09)
Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: realsense_depth_camera_manager
CVE-2021-3312 (published 2021-10-08)
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: alkacon
Affected products: opencms
CVE-2021-33120 (published 2022-02-09)
Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Weakness: CWE-125
Affected vendors: intel
Affected products: atom_p5921b, atom_p5921b_firmware, atom_p5931b, atom_p5931b_firmware, atom_p5942b, atom_p5942b_firmware, atom_p5962b, atom_p5962b_firmware, atom_x6200fe, atom_x6200fe_firmware, atom_x6211e, atom_x6211e_firmware, atom_x6212re, atom_x6212re_firmware, atom_x6413e, atom_x6413e_firmware, atom_x6425e, atom_x6425e_firmware, atom_x6425re, atom_x6425re_firmware, atom_x6427fe, atom_x6427fe_firmware, celeron_j6413, celeron_j6413_firmware, celeron_n4500
CVE-2021-33122 (published 2022-05-12)
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: celeron_n4000, celeron_n4000_firmware, celeron_n4020, celeron_n4020_firmware, celeron_n4100, celeron_n4100_firmware, celeron_n4120, celeron_n4120_firmware, celeron_n4500, celeron_n4500_firmware, celeron_n4505, celeron_n4505_firmware, celeron_n5100, celeron_n5100_firmware, celeron_n5105, celeron_n5105_firmware, core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1, core_i3-1005g1_firmware, core_i3-10100, core_i3-10100_firmware, core_i3-10100e
CVE-2021-33123 (published 2022-05-12)
Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1, core_i3-1005g1_firmware, core_i3-10100, core_i3-10100_firmware, core_i3-10100e, core_i3-10100e_firmware, core_i3-10100f, core_i3-10100f_firmware, core_i3-10100t, core_i3-10100t_firmware, core_i3-10100te, core_i3-10100te_firmware, core_i3-10100y, core_i3-10100y_firmware, core_i3-10105, core_i3-10105_firmware, core_i3-10105f, core_i3-10105f_firmware, core_i3-10105t, core_i3-10105t_firmware, core_i3-10110u
CVE-2021-33124 (published 2022-05-12)
Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1, core_i3-1005g1_firmware, core_i3-10100, core_i3-10100_firmware, core_i3-10100e, core_i3-10100e_firmware, core_i3-10100f, core_i3-10100f_firmware, core_i3-10100t, core_i3-10100t_firmware, core_i3-10100te, core_i3-10100te_firmware, core_i3-10100y, core_i3-10100y_firmware, core_i3-10105, core_i3-10105_firmware, core_i3-10105f, core_i3-10105f_firmware, core_i3-10105t, core_i3-10105t_firmware, core_i3-10110u
CVE-2021-33126 (published 2022-08-18)
Improper access control in the firmware for some Intel(R) 700 and 722 Series Ethernet Controllers and Adapters before versions 8.5 and 1.5.5 may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: ethernet_controller_v710, ethernet_controller_v710_firmware, ethernet_controller_x710, ethernet_controller_x710_firmware, ethernet_controller_xl710, ethernet_controller_xl710_firmware, ethernet_controller_xxv710, ethernet_controller_xxv710_firmware, ethernet_network_adapter_x722da2, ethernet_network_adapter_x722da2_firmware, ethernet_network_adapter_x722da4fh, ethernet_network_adapter_x722da4fh_firmware, ethernet_network_adapter_x722da4g1p5, ethernet_network_adapter_x722da4g1p5_firmware
CVE-2021-33128 (published 2022-08-18)
Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.0.6 may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: ethernet_controller_e810, ethernet_controller_e810_firmware
CVE-2021-33129 (published 2022-02-09)
Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: advisor
CVE-2021-3313 (published 2021-05-20)
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: plone
Affected products: plone
CVE-2021-33130 (published 2022-05-12)
Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-1188
Affected vendors: intel
Affected products: realsense_id_f450, realsense_id_f450_firmware
CVE-2021-33135 (published 2022-05-12)
Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: intel
Affected products: software_guard_extensions
CVE-2021-33137 (published 2022-02-09)
Out-of-bounds write in the Intel(R) Kernelflinger project may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: kernelflinger
CVE-2021-33139 (published 2022-02-09)
Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: intel
Affected products: ac3168, ac3168_firmware, ac_1550, ac_1550_firmware, ac_3165, ac_3165_firmware, ac_7265, ac_7265_firmware, ac_8260, ac_8260_firmware, ac_8265, ac_8265_firmware, ac_9260, ac_9260_firmware, ac_9461, ac_9461_firmware, ac_9462, ac_9462_firmware, ac_9560, ac_9560_firmware, ax1650, ax1650_firmware, ax1675, ax1675_firmware, ax200
CVE-2021-3314 (published 2021-06-25)
Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: oracle
Affected products: glassfish_server
CVE-2021-33141 (published 2024-02-23)
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: ethernet_adapter_complete_driver, ethernet_controller_i225-it, ethernet_controller_i225-it_firmware, ethernet_controller_i225-lm, ethernet_controller_i225-lm_firmware, ethernet_controller_i225-v, ethernet_controller_i225-v_firmware
CVE-2021-33142 (published 2024-02-23)
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: ethernet_adapter_complete_driver, ethernet_controller_i225-it, ethernet_controller_i225-it_firmware, ethernet_controller_i225-lm, ethernet_controller_i225-lm_firmware, ethernet_controller_i225-v, ethernet_controller_i225-v_firmware
CVE-2021-33145 (published 2024-02-23)
Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H)
Weakness: CWE-248
Affected vendors: intel
Affected products: ethernet_adapter_complete_driver, ethernet_controller_i225-it, ethernet_controller_i225-it_firmware, ethernet_controller_i225-lm, ethernet_controller_i225-lm_firmware, ethernet_controller_i225-v, ethernet_controller_i225-v_firmware
CVE-2021-33146 (published 2024-02-23)
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: intel
Affected products: ethernet_adapter_complete_driver, ethernet_controller_i225-it, ethernet_controller_i225-it_firmware, ethernet_controller_i225-lm, ethernet_controller_i225-lm_firmware, ethernet_controller_i225-v, ethernet_controller_i225-v_firmware
CVE-2021-33147 (published 2022-02-09)
Improper conditions check in the Intel(R) IPP Crypto library before version 2021.2 may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-754
Affected vendors: intel
Affected products: integrated_performance_primitives_cryptography
CVE-2021-33149 (published 2022-05-12)
Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: intel
Affected products: atom_processors, atom_processors_firmware, celeron_processors, celeron_processors_firmware, core_processors, core_processors_firmware, itanium_processors, itanium_processors_firmware, pentium_processors, pentium_processors_firmware, quark_soc, quark_soc_firmware, xeon_phi_processors, xeon_phi_processors_firmware, xeon_processors, xeon_processors_firmware