deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20170
Published: 2021-12-30
Description: Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://www.tenable.com/security/research/tra-2021-55; https://www.tenable.com/security/research/tra-2021-55
CVE: CVE-2021-20171
Published: 2021-12-30
Description: Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.tenable.com/security/research/tra-2021-55; https://www.tenable.com/security/research/tra-2021-55
CVE: CVE-2021-20172
Published: 2021-12-30
Description: All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the software is going to be installed may overwrite certain files to obtain privilege escalation to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.tenable.com/security/research/tra-2021-56; https://www.tenable.com/security/research/tra-2021-56
CVE: CVE-2021-20173
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-20174
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-20175
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-23147
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-44466
Published: 2021-12-30
Description: Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://www.tenable.com/security/research/tra-2021-58; https://www.tenable.com/security/research/tra-2021-58
CVE: CVE-2021-45077
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-45732
Published: 2021-12-30
Description: Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools, a user can reconfigure settings not intended to be manipulated, repackage the configuration, and restore a backup causing these settings to be changed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://www.tenable.com/security/research/tra-2021-57; https://www.tenable.com/security/research/tra-2021-57
CVE: CVE-2021-4181
Published: 2021-12-30
Description: Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4181.json; https://gitlab.com/wireshark/wireshark/-/merge_requests/5429; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2021-4182
Published: 2021-12-30
Description: Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4182.json; https://gitlab.com/wireshark/wireshark/-/issues/17801; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT/
CVE: CVE-2021-4183
Published: 2021-12-30
Description: Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4183.json; https://gitlab.com/wireshark/wireshark/-/issues/17755; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT/
CVE: CVE-2021-4184
Published: 2021-12-30
Description: Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4184.json; https://gitlab.com/wireshark/wireshark/-/issues/17754; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2021-4185
Published: 2021-12-30
Description: Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4185.json; https://gitlab.com/wireshark/wireshark/-/issues/17745; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2021-4186
Published: 2021-12-30
Description: Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-476
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4186.json; https://gitlab.com/wireshark/wireshark/-/issues/17737; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/
CVE: CVE-2021-4190
Published: 2021-12-30
Description: Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4190.json; https://gitlab.com/wireshark/wireshark/-/issues/17811; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT/
CVE: CVE-2021-4192
Published: 2021-12-31
Description: vim is vulnerable to Use After Free
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2022/Jul/14; http://seclists.org/fulldisclosure/2022/Mar/29; http://seclists.org/fulldisclosure/2022/May/35
CVE: CVE-2021-4193
Published: 2021-12-31
Description: vim is vulnerable to Out-of-bounds Read
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://seclists.org/fulldisclosure/2022/Jul/14; http://seclists.org/fulldisclosure/2022/Mar/29; http://seclists.org/fulldisclosure/2022/May/35
CVE: CVE-2021-45929
Published: 2022-01-01
Description: Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from CompileElseBlock and Compile_If).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36551; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wasm3/OSV-2021-1061.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36551
CVE: CVE-2021-45944
Published: 2022-01-01
Description: Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29903; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30715; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7861fcad13c497728189feafb41cd57b5b50ea25
CVE: CVE-2021-45945
Published: 2022-01-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45946
Published: 2022-01-01
Description: Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from Compile_LoopOrBlock and CompileBlockStatements).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33555; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wasm3/OSV-2021-678.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33555
CVE: CVE-2021-45947
Published: 2022-01-01
Description: Wasm3 0.5.0 has an out-of-bounds write in Runtime_Release (called from EvaluateExpression and InitDataSegments).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33689; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wasm3/OSV-2021-689.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33689
CVE: CVE-2021-45948
Published: 2022-01-01
Description: Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-based buffer overflow in _m3d_safestr (called from m3d_load and Assimp::M3DWrapper::M3DWrapper).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2021-775.yaml; https://security.gentoo.org/glsa/202210-01
CVE: CVE-2021-45949
Published: 2022-01-01
Description: Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675; https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
CVE: CVE-2021-45950
Published: 2022-01-01
Description: LibreDWG 0.12.4.4313 through 0.12.4.4367 has an out-of-bounds write in dwg_free_BLOCK_private (called from dwg_free_BLOCK and dwg_free_object).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34766; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libredwg/OSV-2021-814.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34766
CVE: CVE-2021-45951
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in check_bad_address (called from check_for_bogus_wildcard and FuzzCheckForBogusWildcard). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35868; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-924.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45952
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35870; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-927.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45953
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from hash_questions and fuzz_util.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35858; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-929.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45954
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from answer_auth and FuzzAuth). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35861; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-931.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45955
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c) because of the lack of a proper bounds check upon pseudo header re-insertion. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge." However, a contributor states that a security patch (mentioned in 016162.html) is needed
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-932.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45956
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35887; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-933.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45957
Published: 2022-01-01
Description: Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35920; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-935.yaml; https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html
CVE: CVE-2021-45958
Published: 2022-01-01
Description: UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yaml; https://github.com/ultrajson/ultrajson/issues/501
CVE: CVE-2021-45959
Published: 2022-01-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-45926
Published: 2022-01-01
Description: MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35972; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mdbtools/OSV-2021-958.yaml; https://github.com/mdbtools/mdbtools/commit/373b7ff4c4daf887269c078407cb1338942c4ea6
CVE: CVE-2021-45927
Published: 2022-01-01
Description: MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd6e029ee0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36187; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mdbtools/OSV-2021-1003.yaml; https://github.com/mdbtools/mdbtools/commit/373b7ff4c4daf887269c078407cb1338942c4ea6
CVE: CVE-2021-45928
Published: 2022-01-01
Description: libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup (called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36456; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libvips/OSV-2021-1055.yaml; https://github.com/libjxl/libjxl/compare/v0.5...v0.6
CVE: CVE-2021-45930
Published: 2022-01-01
Description: Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
CVE: CVE-2021-45931
Published: 2022-01-01
Description: HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37425; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/harfbuzz/OSV-2021-1159.yaml; https://github.com/harfbuzz/harfbuzz/commit/d3e09bf4654fe5478b6dbf2b26ebab6271317d81
CVE: CVE-2021-45932
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (4 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37866; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1188.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45933
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (8 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38237; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1211.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45934
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_HandlePacket and MqttClient_WaitType).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38146; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1204.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45935
Published: 2022-01-01
Description: Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func<std::__1::__bind<grk::T1DecompressScheduler::deco and std::__1::packaged_task<int).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39021; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/grok/OSV-2021-1344.yaml; https://github.com/osamu620/OpenHTJ2K
CVE: CVE-2021-45936
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttDecode_Disconnect (called from MqttClient_DecodePacket and MqttClient_WaitType).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39053; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1348.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45937
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Connect).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39083; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1349.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45938
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Unsubscribe).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39056; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1353.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2
CVE: CVE-2021-45939
Published: 2022-01-01
Description: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Subscribe).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39103; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/wolfmqtt/OSV-2021-1361.yaml; https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2