deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38616
Published: 2021-09-07
Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.
CVSS Score: 7.6 (HIGH)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38616; https://eigentech.com/; https://excellium-services.com/cert-xlm-advisory/
CVE: CVE-2021-38617
Published: 2021-09-07
Description: In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.
CVSS Score: 8.8 (HIGH)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38617; https://eigentech.com/; https://excellium-services.com/cert-xlm-advisory/
CVE: CVE-2021-38698
Published: 2021-09-07
Description: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026; https://security.gentoo.org/glsa/202208-09; https://www.hashicorp.com/blog/category/consul
CVE: CVE-2019-5318
Published: 2021-09-07
Description: A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all versions prior to 8.8.0.0. Aruba has released patches for ArubaOS that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-33599
Published: 2021-09-07
Description: A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-835
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-33599; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2021-37716
Published: 2021-09-07
Description: A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37717
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37718
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37719
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt
CVE: CVE-2021-37720
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37721
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37722
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37723
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37724
Published: 2021-09-07
Description: A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37725
Published: 2021-09-07
Description: A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37728
Published: 2021-09-07
Description: A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13. Aruba has released patches for ArubaOS that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37729
Published: 2021-09-07
Description: A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3, 8.6.0.9, 8.5.0.12, 8.3.0.16, 6.5.4.19, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37731
Published: 2021-09-07
Description: A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-37733
Published: 2021-09-07
Description: A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.11, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf
CVE: CVE-2021-39285
Published: 2021-09-07
Description: A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pbgt/CVEs/blob/main/CVE-2021-39285.md; https://versa-networks.com; https://github.com/pbgt/CVEs/blob/main/CVE-2021-39285.md
CVE: CVE-2021-27022
Published: 2021-09-07
Description: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://puppet.com/security/cve/cve-2021-27022/; https://puppet.com/security/cve/cve-2021-27022/%5D; https://puppet.com/security/cve/cve-2021-27022/
CVE: CVE-2021-33285
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: http://www.openwall.com/lists/oss-security/2021/08/30/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386; https://bugzilla.redhat.com/show_bug.cgi?id=2001608
CVE: CVE-2021-33289
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
CVE: CVE-2021-35268
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
CVE: CVE-2021-35269
Published: 2021-09-07
Description: NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2020-19131
Published: 2021-09-07
Description: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/; http://bugzilla.maptools.org/show_bug.cgi?id=2831; https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
CVE: CVE-2020-7819
Published: 2021-09-07
Description: A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-200, CWE-89
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36223; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36223
CVE: CVE-2020-7832
Published: 2021-09-07
Description: A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36231; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36231
CVE: CVE-2020-7865
Published: 2021-09-07
Description: A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpDownload function. A successful exploit could allow the attacker to hijack vulnerable system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36229; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36229
CVE: CVE-2021-33286
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
CVE: CVE-2021-33287
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: http://ntfs-3g.com; http://tuxera.com; http://www.openwall.com/lists/oss-security/2021/08/30/1
CVE: CVE-2021-35266
Published: 2021-09-07
Description: In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
CVE: CVE-2021-35267
Published: 2021-09-07
Description: NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://ntfs-3g.com; http://www.openwall.com/lists/oss-security/2021/08/30/1; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
CVE: CVE-2021-39251
Published: 2021-09-07
Description: A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-20, CWE-476
References: http://www.openwall.com/lists/oss-security/2021/08/30/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386; https://bugzilla.redhat.com/show_bug.cgi?id=2001649
CVE: CVE-2021-39252
Published: 2021-09-07
Description: A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-20, CWE-125
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39253
Published: 2021-09-07
Description: A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-20, CWE-125
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39254
Published: 2021-09-07
Description: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-20, CWE-190
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39255
Published: 2021-09-07
Description: A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39256
Published: 2021-09-07
Description: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39257
Published: 2021-09-07
Description: A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39258
Published: 2021-09-07
Description: A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39259
Published: 2021-09-07
Description: A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39260
Published: 2021-09-07
Description: A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39261
Published: 2021-09-07
Description: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39262
Published: 2021-09-07
Description: A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-39263
Published: 2021-09-07
Description: A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp; https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html
CVE: CVE-2021-38123
Published: 2021-09-07
Description: Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://portal.microfocus.com/s/article/KM000001673; https://portal.microfocus.com/s/article/KM000001673