deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20332
Published: 2021-08-02
Description: Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://jira.mongodb.org/browse/RUST-591; https://jira.mongodb.org/browse/RUST-591
CVE: CVE-2021-37160
Published: 2021-08-02
Description: A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation (e.g., cryptographic signature validation) during a File Upload for a firmware update.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37160-bulletin---no-firmware-update-validation.pdf?rev=c7f94647037c4007992e2e626d445561&hash=E[PII_REDACTED]0A809FB74994018BA1248
CVE: CVE-2021-37161
Published: 2021-08-02
Description: A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37161-bulletin---underflow-in-udprxthread.pdf?rev=9395dad86d0b4811ae4a9e37f0568c2e&hash=3D8571C7A3DCC8B7D8DCB89C2DA4BB8D
CVE: CVE-2021-37162
Published: 2021-08-02
Description: A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message, a buffer underflow occurs, leading to an out-of-bounds copy and possible remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37162-bulletin---overflow-in-sccprocessmsg.pdf?rev=55a2a1d[PII_REDACTED]8a8479970fc54bf&hash=4FDAB2F0EB319F0B773500669D67F3AD
CVE: CVE-2021-37163
Published: 2021-08-02
Description: An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software 7.2.5.7. The device has two user accounts with passwords that are hardcoded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37163-bulletin---default-credentials-for-the-telnet-server.pdf?rev=da64c389a475494985b9fd2c2c508542&hash=466A7109AF08EBFF3756B2C25968ED5E
CVE: CVE-2021-37164
Published: 2021-08-02
Description: A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function, the received data is copied to a stack buffer. An off-by-3 condition can occur, resulting in a stack-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37164-bulletin---off-by-three-stack-overflow-in-tcptxthread.pdf?rev=daf615075c71484c8059c906872a51e6&hash=1FCC1A5D921E231D71E6B95A9AA8B741
CVE: CVE-2021-37166
Published: 2021-08-02
Description: A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37166-bulletin---gui-socket-denial-of-service.pdf?rev=05321b2af1064eb2a6d6e6bf77604c6b&hash=40A927FE1153AA980428C93B2EF7EB40
CVE: CVE-2021-37167
Published: 2021-08-02
Description: An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A user logged in using the default credentials can gain root access to the device, which provides permissions for all of the functionality of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://www.armis.com/PwnedPiper; https://www.swisslog-healthcare.com; https://www.swisslog-healthcare.com/-/media/swisslog-healthcare/documents/customer-service/armis-documents/cve-2021-37167-bulletin---privilege-escalation.pdf?rev=20c909e5f[PII_REDACTED]0b52471f266fc&hash=F43731C7A882EEBB5CE28DFBC75933D3
CVE: CVE-2021-37840
Published: 2021-08-02
Description: aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
CVSS Score: 8.8 (HIGH)
References: https://github.com/aaPanel/aaPanel/issues/74; https://ssd-disclosure.com/ssd-advisory-aapanel-cswh-to-rce/; https://github.com/aaPanel/aaPanel/issues/74
CVE: CVE-2021-29741
Published: 2021-08-02
Description: IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges. IBM X-Force ID: 201478.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201478; https://www.ibm.com/support/pages/node/6477018; https://exchange.xforce.ibmcloud.com/vulnerabilities/201478
CVE: CVE-2021-22552
Published: 2021-08-02
Description: An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a; https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
CVE: CVE-2021-29757
Published: 2021-08-02
Description: IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202168.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202168; https://www.ibm.com/support/pages/node/6477204; https://exchange.xforce.ibmcloud.com/vulnerabilities/202168
CVE: CVE-2021-20539
Published: 2021-08-02
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198920; https://www.ibm.com/support/pages/node/6476940; https://exchange.xforce.ibmcloud.com/vulnerabilities/198920
CVE: CVE-2021-20540
Published: 2021-08-02
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198923; https://www.ibm.com/support/pages/node/6476940; https://exchange.xforce.ibmcloud.com/vulnerabilities/198923
CVE: CVE-2021-20541
Published: 2021-08-02
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198927.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198927; https://www.ibm.com/support/pages/node/6476940; https://exchange.xforce.ibmcloud.com/vulnerabilities/198927
CVE: CVE-2021-22379
Published: 2021-08-02
Description: There is an Integer Underflow (Wrap or Wraparound) Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS of Samgr.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22381
Published: 2021-08-02
Description: There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22384
Published: 2021-08-02
Description: There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22387
Published: 2021-08-02
Description: There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to remotely execute commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22388
Published: 2021-08-02
Description: There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22389
Published: 2021-08-02
Description: There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22390
Published: 2021-08-02
Description: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22391
Published: 2021-08-02
Description: There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22392
Published: 2021-08-02
Description: There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification bypass and directions to abnormal addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22396
Published: 2021-08-02
Description: There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access some specific files in the affected products. Successful exploit will cause privilege escalation.Affected product versions include:eCNS280_TD V100R005C00,V100R005C10;eSE620X vESS V100R001C10SPC200,V100R001C20SPC200.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-privilege-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-privilege-en
CVE: CVE-2021-22397
Published: 2021-08-02
Description: There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-pe-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-pe-en
CVE: CVE-2021-22398
Published: 2021-08-02
Description: There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations. Affected product versions include: Hulk-AL00C 9.1.1.201(C00E201R8P1);Jennifer-AN00C 10.1.1.171(C00E170R6P3);Jenny-AL10B 10.1.0.228(C00E220R5P1) and OxfordPL-AN10B 10.1.0.116(C00E110R2P1).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-smartphone-en
CVE: CVE-2021-22412
Published: 2021-08-02
Description: There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random kernel address access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22413
Published: 2021-08-02
Description: There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22414
Published: 2021-08-02
Description: There is a Memory Buffer Errors Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22415
Published: 2021-08-02
Description: There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause kernel exceptions with the code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22427
Published: 2021-08-02
Description: There is a Heap-based Buffer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22428
Published: 2021-08-02
Description: There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-459
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22435
Published: 2021-08-02
Description: There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22438
Published: 2021-08-02
Description: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause malicious code to be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22442
Published: 2021-08-02
Description: There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22443
Published: 2021-08-02
Description: There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random address access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22444
Published: 2021-08-02
Description: There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-29696
Published: 2021-08-02
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200597; https://www.ibm.com/support/pages/node/6476940; https://exchange.xforce.ibmcloud.com/vulnerabilities/200597
CVE: CVE-2021-29697
Published: 2021-08-02
Description: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/200598; https://www.ibm.com/support/pages/node/6476940; https://exchange.xforce.ibmcloud.com/vulnerabilities/200598
CVE: CVE-2021-22445
Published: 2021-08-02
Description: There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22446
Published: 2021-08-02
Description: There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-22447
Published: 2021-08-02
Description: There is an Improper Check for Unusual or Exceptional Conditions Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://consumer.huawei.com/en/support/bulletin/2021/6/; https://consumer.huawei.com/en/support/bulletin/2021/6/
CVE: CVE-2021-32806
Published: 2021-08-02
Description: Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://jvn.jp/en/jp/JVN50804280/index.html; https://github.com/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba; https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr
CVE: CVE-2021-32810
Published: 2021-08-02
Description: crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362, CWE-362
References: https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EZILHZDRGDPOBQ4KTW3E5PPMKLHGH5N/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWHNNBJCU4EHA2X5ZAMJMGLDUYS5FEPP/
CVE: CVE-2021-33195
Published: 2021-08-02
Description: Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74
References: https://groups.google.com/g/golang-announce; https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI; https://security.gentoo.org/glsa/202208-02
CVE: CVE-2021-33196
Published: 2021-08-02
Description: In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://groups.google.com/g/golang-announce; https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI; https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html