deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28715
Published: 2022-01-06
Description: Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html; https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html; https://www.debian.org/security/2022/dsa-5050
CVE: CVE-2021-43045
Published: 2022-01-06
Description: A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2022/01/06/8; https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd; http://www.openwall.com/lists/oss-security/2022/01/06/8
CVE: CVE-2021-4194
Published: 2022-01-06
Description: bookstack is vulnerable to Improper Access Control
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/bookstackapp/bookstack/commit/cb0d674a71449de883713db2fcdccb6e108992ad; https://huntr.dev/bounties/0bc8b3f7-9057-4eb7-a989-24cd5689f114; https://github.com/bookstackapp/bookstack/commit/cb0d674a71449de883713db2fcdccb6e108992ad
CVE: CVE-2021-46039
Published: 2022-01-06
Description: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context-dependent).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1999; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1999
CVE: CVE-2021-46040
Published: 2022-01-06
Description: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (context-dependent).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2003; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2003
CVE: CVE-2021-46041
Published: 2022-01-06
Description: A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/gpac/gpac/issues/2004; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2004
CVE: CVE-2021-46042
Published: 2022-01-06
Description: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2002; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2002
CVE: CVE-2021-42841
Published: 2022-01-06
Description: Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210416; https://exchange.xforce.ibmcloud.com/vulnerabilities/210416
CVE: CVE-2021-46043
Published: 2022-01-06
Description: A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2001; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2001
CVE: CVE-2021-46044
Published: 2022-01-06
Description: A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2006; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2006
CVE: CVE-2022-21661
Published: 2022-01-06
Description: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html; https://github.com/WordPress/wordpress-develop/commit/17efac8c8ec64555eff5cf51a3eff81e06317214; https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
CVE: CVE-2022-21662
Published: 2022-01-06
Description: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w; https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/
CVE: CVE-2022-21663
Published: 2022-01-06
Description: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-74, CWE-502
References: https://blog.sonarsource.com/wordpress-object-injection-vulnerability/; https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jmmq-m8p8-332h; https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html
CVE: CVE-2022-21664
Published: 2022-01-06
Description: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/WordPress/wordpress-develop/commit/c09ccfbc547d75b392dbccc1ef0b4442ccd3c957; https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jp3p-gw8h-6x86; https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html
CVE: CVE-2021-25743
Published: 2022-01-07
Description: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
CVSS Score: 3.0 (LOW)
CWE: CWE-150
References: https://github.com/kubernetes/kubernetes/issues/101695; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/kubernetes/kubernetes/issues/101695
CVE: CVE-2021-38674
Published: 2022-01-07
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-63; https://www.qnap.com/en/security-advisory/qsa-21-63
CVE: CVE-2020-10137
Published: 2022-01-10
Description: Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthenticated attacker to inject a FIND_NODE_IN_RANGE frame with an invalid random payload, denying service by blocking the processing of upcoming events.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2020-29050
Published: 2022-01-10
Description: SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/; https://lists.debian.org/debian-lts-announce/2022/01/msg00009.html; https://security-tracker.debian.org/tracker/CVE-2020-29050
CVE: CVE-2020-9057
Published: 2022-01-10
Description: Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311, CWE-311
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2020-9058
Published: 2022-01-10
Description: Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-311
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2020-9059
Published: 2022-01-10
Description: Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaustion. As an example, the Schlage BE468 version 3.42 door lock is vulnerable and fails open at a low battery level.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2020-9060
Published: 2022-01-10
Description: Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346, CWE-400, CWE-400
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2020-9061
Published: 2022-01-10
Description: Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://doi.org/10.1109/ACCESS.2[PII_REDACTED]; https://github.com/CNK2100/VFuzz-public; https://ieeexplore.ieee.org/document/9663293
CVE: CVE-2021-20046
Published: 2022-01-10
Description: A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0027; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0027
CVE: CVE-2021-20048
Published: 2022-01-10
Description: A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0028; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0028
CVE: CVE-2021-22060
Published: 2022-01-10
Description: In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
CVSS Score: 4.3 (MEDIUM)
References: https://tanzu.vmware.com/security/cve-2021-22060; https://www.oracle.com/security-alerts/cpuapr2022.html; https://tanzu.vmware.com/security/cve-2021-22060
CVE: CVE-2021-22569
Published: 2022-01-10
Description: An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-696
References: http://www.openwall.com/lists/oss-security/2022/01/12/4; http://www.openwall.com/lists/oss-security/2022/01/12/7; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
CVE: CVE-2021-23173
Published: 2022-01-10
Description: The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
CVSS Score: 2.6 (LOW)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-006-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-006-01
CVE: CVE-2021-23543
Published: 2022-01-10
Description: All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309908; https://www.npmjs.com/package/realms-shim; https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309908
CVE: CVE-2021-23568
Published: 2022-01-10
Description: The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60; https://github.com/eggjs/extend2/commit/aa332a59116c[PII_REDACTED]b57ea477c6823054f8; https://github.com/eggjs/extend2/pull/2
CVE: CVE-2021-23594
Published: 2022-01-10
Description: All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309907; https://www.npmjs.com/package/realms-shim; https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309907
CVE: CVE-2021-30360
Published: 2022-01-10
Description: Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0001/MNDT-2022-0001.md; https://supportcontent.checkpoint.com/solutions?id=sk176853; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0001/MNDT-2022-0001.md
CVE: CVE-2021-32996
Published: 2022-01-10
Description: The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-192, CWE-681, CWE-681
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02
CVE: CVE-2021-32998
Published: 2022-01-10
Description: The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required.
CVSS Score: 7.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02
CVE: CVE-2021-34086
Published: 2022-01-10
Description: In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf; https://ultimaker.com/3d-printers/ultimaker-3; https://ultimaker.com/3d-printers/ultimaker-s3
CVE: CVE-2021-34087
Published: 2022-01-10
Description: In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver can be used for clickjacking. This includes the settings page.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1021
References: https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf; https://ultimaker.com/3d-printers/ultimaker-s3; https://ultimaker.com/3d-printers/ultimaker-s5
CVE: CVE-2021-35247
Published: 2022-01-10
Description: Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
CVE: CVE-2021-38894
Published: 2022-01-10
Description: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 209515.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209515; https://www.ibm.com/support/pages/node/6538418; https://exchange.xforce.ibmcloud.com/vulnerabilities/209515
CVE: CVE-2021-38895
Published: 2022-01-10
Description: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209563.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209563; https://www.ibm.com/support/pages/node/6538418; https://exchange.xforce.ibmcloud.com/vulnerabilities/209563
CVE: CVE-2021-38921
Published: 2022-01-10
Description: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210067.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210067; https://www.ibm.com/support/pages/node/6538418; https://exchange.xforce.ibmcloud.com/vulnerabilities/210067
CVE: CVE-2021-38956
Published: 2022-01-10
Description: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks against the system. IBM X-Force ID: 212038
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212038; https://www.ibm.com/support/pages/node/6538418; https://exchange.xforce.ibmcloud.com/vulnerabilities/212038
CVE: CVE-2021-38957
Published: 2022-01-10
Description: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Force ID: 212040.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212040; https://www.ibm.com/support/pages/node/6538418; https://exchange.xforce.ibmcloud.com/vulnerabilities/212040
CVE: CVE-2021-38990
Published: 2022-01-10
Description: IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM X-Force ID: 212952.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212952; https://www.ibm.com/support/pages/node/6515496; https://www.ibm.com/support/pages/node/6538700
CVE: CVE-2021-39993
Published: 2022-01-10
Description: There is an Integer overflow vulnerability with ACPU in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/12/; https://consumer.huawei.com/en/support/bulletin/2021/12/