deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23395
Published: 2022-03-02
Description: jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1321
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/test/npm/jquery.cookie/1.4.1?tab=issues; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-23779
Published: 2022-03-02
Description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.manageengine.com/products/desktop-central/cve-2022-23779.html; https://www.manageengine.com/products/desktop-central/cve-2022-23779.html
CVE: CVE-2022-24305
Published: 2022-03-02
Description: Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
References: https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329; https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329
CVE: CVE-2022-24306
Published: 2022-03-02
Description: Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329; https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329
CVE: CVE-2022-24447
Published: 2022-03-02
Description: An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.
CVSS Score: 6.5 (MEDIUM)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-24447; https://excellium-services.com/cert-xlm-advisory/cve-2022-24447/; https://www.manageengine.com/key-manager/release-notes.html#6200
CVE: CVE-2022-25634
Published: 2022-03-02
Description: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://codereview.qt-project.org/c/qt/qtbase/+/396440; https://codereview.qt-project.org/c/qt/qtbase/+/396689; https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690
CVE: CVE-2022-0819
Published: 2022-03-02
Description: Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/dolibarr/dolibarr/commit/2a48dd349e7de0d4a38e448b0d2ecbe25e968075; https://huntr.dev/bounties/b03d4415-d4f9-48c8-9ae2-d3aa248027b5; https://github.com/dolibarr/dolibarr/commit/2a48dd349e7de0d4a38e448b0d2ecbe25e968075
CVE: CVE-2021-38996
Published: 2022-03-02
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213076.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213076; https://www.ibm.com/support/pages/node/6560390; https://exchange.xforce.ibmcloud.com/vulnerabilities/213076
CVE: CVE-2021-43070
Published: 2022-03-02
Description: Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-21-106; https://fortiguard.com/psirt/FG-IR-21-106
CVE: CVE-2022-22350
Published: 2022-03-02
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220394.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220394; https://www.ibm.com/support/pages/node/6560390; https://exchange.xforce.ibmcloud.com/vulnerabilities/220394
CVE: CVE-2022-25016
Published: 2022-03-02
Description: Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/lohyt/web-shell-via-file-upload-in-hocms; https://github.com/lohyt/web-shell-via-file-upload-in-hocms
CVE: CVE-2021-38268
Published: 2022-03-02
Description: The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP
CVE: CVE-2022-23878
Published: 2022-03-02
Description: seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.csdn.net/miuzzx/article/details/122249953; https://blog.csdn.net/miuzzx/article/details/122249953
CVE: CVE-2022-23640
Published: 2022-03-02
Description: Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-776
References: https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73; https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f; https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73
CVE: CVE-2022-0675
Published: 2022-03-02
Description: In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1289, CWE-20
References: https://puppet.com/security/cve/CVE-2022-0675; https://puppet.com/security/cve/CVE-2022-0675
CVE: CVE-2022-22944
Published: 2022-03-02
Description: VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2022-0006.html; https://www.vmware.com/security/advisories/VMSA-2022-0006.html
CVE: CVE-2022-23656
Published: 2022-03-02
Description: Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321; https://github.com/zulip/zulip/security/advisories/GHSA-fc77-h3jc-6mfv; https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321
CVE: CVE-2022-23953
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2022-23956
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2022-25045
Published: 2022-03-02
Description: Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/VivekPanday12/CVE-/issues/6; https://www.linkedin.com/in/vivek-panday-796768149/; https://github.com/VivekPanday12/CVE-/issues/6
CVE: CVE-2021-41000
Published: 2022-03-02
Description: Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
CVE: CVE-2021-41001
Published: 2022-03-02
Description: An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
CVE: CVE-2021-41002
Published: 2022-03-02
Description: Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
CVE: CVE-2021-41003
Published: 2022-03-02
Description: Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.
CVSS Score: 6.1 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
CVE: CVE-2021-45074
Published: 2022-03-02
Description: JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45074%3A+Artifactory+Broken+Access+Control+on+Delete+OAuth+Tokens; https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories; https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45074%3A+Artifactory+Broken+Access+Control+on+Delete+OAuth+Tokens
CVE: CVE-2021-46270
Published: 2022-03-02
Description: JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46270%3A+Artifactory+Project+Admin+Repository+Name+Disclosure; https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories; https://www.jfrog.com/confluence/display/JFROG/CVE-2021-46270%3A+Artifactory+Project+Admin+Repository+Name+Disclosure
CVE: CVE-2022-0711
Published: 2022-03-02
Description: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://access.redhat.com/security/cve/cve-2022-0711; https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8; https://www.debian.org/security/2022/dsa-5102
CVE: CVE-2022-23954
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2022-23955
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2022-23957
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2022-23958
Published: 2022-03-02
Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]718-16
CVE: CVE-2021-23180
Published: 2022-03-02
Description: A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967041; https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751a; https://github.com/michaelrsweet/htmldoc/issues/418
CVE: CVE-2021-23191
Published: 2022-03-02
Description: A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967022; https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc; https://github.com/michaelrsweet/htmldoc/issues/415
CVE: CVE-2021-23192
Published: 2022-03-02
Description: A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2019666; https://security.gentoo.org/glsa/202309-06; https://ubuntu.com/security/CVE-2021-23192
CVE: CVE-2021-23206
Published: 2022-03-02
Description: A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967028; https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8; https://github.com/michaelrsweet/htmldoc/issues/416
CVE: CVE-2021-23222
Published: 2022-03-02
Description: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=2022675; https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=d83cdfdca9d918bbbd6bb209139b94c954da7228; https://github.com/postgres/postgres/commit/160c0258802d10b0600d7671b1bbea55d8e17d45
CVE: CVE-2021-38266
Published: 2022-03-02
Description: The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
CVSS Score: 7.5 (HIGH)
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17191; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38266
CVE: CVE-2021-3623
Published: 2022-03-02
Description: A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1976806; https://github.com/stefanberger/libtpms/commit/2e6173c; https://github.com/stefanberger/libtpms/commit/2f30d62
CVE: CVE-2021-3631
Published: 2022-03-02
Description: A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://access.redhat.com/errata/RHSA-2021:3631; https://bugzilla.redhat.com/show_bug.cgi?id=1977726; https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2
CVE: CVE-2021-3654
Published: 2022-03-02
Description: A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://bugs.launchpad.net/nova/+bug/1927677; https://bugs.python.org/issue32084; https://bugzilla.redhat.com/show_bug.cgi?id=1961439
CVE: CVE-2021-3658
Published: 2022-03-02
Description: bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1984728; https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055; https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055
CVE: CVE-2021-3667
Published: 2022-03-02
Description: An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://bugzilla.redhat.com/show_bug.cgi?id=1986094; https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87; https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87
CVE: CVE-2021-3677
Published: 2022-03-02
Description: A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=2001857; https://security.gentoo.org/glsa/202211-04; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-3715
Published: 2022-03-02
Description: A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef299cc3fa1a9e1288665a9fdc8bff55629fd359; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef299cc3fa1a9e1288665a9fdc8bff55629fd359